Description
WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's EPG (Electronic Program Guide) feature parses XML from user-controlled URLs and renders programme titles directly into HTML without any sanitization or escaping. A user with upload permission can set a video's epg_link to a malicious XML file whose <title> elements contain JavaScript. This payload executes in the browser of any unauthenticated visitor to the public EPG page, enabling session hijacking and account takeover.
Problem types
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Product status
References
github.com/...AVideo/security/advisories/GHSA-rqp3-gf5h-mrqx
github.com/...AVideo/security/advisories/GHSA-rqp3-gf5h-mrqx
github.com/...ommit/e0212add4aad0f1e97758a4b4fdc57df58ce68e8