Threats tagged 'ghsa-vvhx-2623-xf2x'

WWBN AVideo versions 14.3 through 29.7.1 are affected by a stored cross-site scripting (XSS) vulnerability. This flaw allows uploaders to inject malicious scripts via the videoDownloadedLink parameter, which is stored without proper escaping. The injected scripts execute in administrator sessions through a Source tag rendered in the video management interface, potentially enabling attackers to install plugin archives containing PHP code.