Threats tagged 'ghsa-hv73-qqrq-m373'

AVideo versions before 29.1.0 contain a stored cross-site scripting (XSS) vulnerability in the video trailer1 field. This field is rendered unsanitized within an inline onclick JavaScript string, allowing attackers with video upload permissions to inject HTML entity-encoded payloads. These payloads bypass URL validation and are decoded by browsers, enabling execution of arbitrary code in visitors' sessions, including administrators. The vulnerability has a medium severity with a CVSS score of 5.1.