A cross-site scripting (XSS) vulnerability exists in the videosList page parameter of WWBN AVideo version 14.4 and the development master commit 8a8954ff. This flaw allows an attacker to execute arbitrary JavaScript by tricking a user into visiting a specially crafted webpage. The vulnerability has a critical severity rating with a CVSS score of 9.0.