CVE-2026-72747

medium

Description

AVideo fails to sanitize the phone field during user registration, allowing unauthenticated attackers to inject malicious JavaScript that persists in the database. When administrators visit the users management page, the unsanitized phone value is rendered via innerHTML, executing the injected script in the admin's browser session.

References

https://www.vulncheck.com/advisories/avideo-stored-cross-site-scripting-via-unauthenticated-registration

https://github.com/WWBN/AVideo/security/advisories/GHSA-cfvq-r985-84wj

https://github.com/WWBN/AVideo/commit/1adcb75458a3b31058655698a833e8cbde4d0593

Details

Source: Mitre, NVD

Published: 2026-08-11

Updated: 2026-08-11

Risk Information

CVSS v2

Base Score: 6.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 7.2

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Severity: High

CVSS v4

Base Score: 5.1

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Severity: Medium

EPSS

EPSS: 0.00259