Threats tagged 'ghsa-8whc-2wmv-ww35'

A stored DOM Cross-Site Scripting (XSS) vulnerability exists in the YPTSocket plugin of the AVideo platform (WWBN). An unauthenticated attacker can inject arbitrary JavaScript via the webSocketSelfURI and page_title parameters, which are broadcast to all connected administrator clients viewing the YPTSocket online-users debug panel. This occurs because these parameters are stored without validation and later inserted into the DOM using jQuery's append method without proper sanitization. The vulnerability affects versions prior to 29.1.0 and has a CVSS score of 9.6, indicating critical severity.