WWBN AVideo version 0 contains a reflected XSS vulnerability in confirmLivePassword.php. The vulnerability arises because the script copies the REQUEST_URI directly into a form's action attribute without encoding special characters. An attacker can exploit this by crafting a URL containing a quote character to break out of the attribute context and inject malicious event handlers. These handlers execute in the context of the vulnerable site, potentially leading to script execution in the victim's browser.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected site within the victim's browser. This can lead to actions such as session hijacking, defacement, or other malicious activities limited to the site's origin. The vulnerability requires user interaction (UI:P) and has low privileges required (PR:N). There are no known exploits in the wild at this time.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid clicking suspicious URLs that target confirmLivePassword.php. Developers should ensure proper encoding of user-controllable input when inserting it into HTML attributes to prevent XSS.