AVideo through version 29.0 contains a stored cross-site scripting vulnerability in the view-counter endpoint (objects/videoAddViewCount.json.php). This endpoint calls VideoStatistic::save(), which stores the User-Agent string from the request into the `app` column of the videos_statistics table without sanitizing it properly. The setter setApp() that sanitizes input is bypassed, and normalization only truncates the string to 45 characters. The video statistics page (view/videoViewsInfo.php) renders this field using DataTables 1.12.1 with an unescaped renderer that assigns content via innerHTML, enabling execution of attacker-supplied HTML in the authenticated session of video owners and administrators. No official fix or patch was available at the time of the advisory.

An attacker can supply a malicious User-Agent string to the unauthenticated view-counter endpoint, which is stored and later rendered unsanitized in the statistics page viewed by privileged users. This allows execution of arbitrary HTML and JavaScript in the context of the victim's browser session, potentially leading to session hijacking, privilege escalation, or other attacks within the authenticated session. The vulnerability affects confidentiality and integrity of the affected users' sessions.

No official patch or fix was available at the time of the advisory. Users should exercise caution when viewing the video statistics page and consider restricting access to trusted users only. Monitor vendor advisories for updates or patches addressing this vulnerability. Avoid exposing the view-counter endpoint to untrusted sources if possible.