CyberRota Analysis
AI-GeneratedAVideo is vulnerable due to inadequate sanitization of the phone field during user registration, allowing unauthenticated attackers to inject persistent malicious JavaScript into the database. This vulnerability can lead to cross-site scripting (XSS) attacks, executing the injected script in the administrator's browser when accessing the user management page. Organizations using AVideo should prioritize patching this issue to protect against potential exploitation and data compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
AVideo fails to sanitize the phone field during user registration, allowing unauthenticated attackers to inject malicious JavaScript that persists in the database. When administrators visit the users management page, the unsanitized phone value is rendered via innerHTML, executing the injected script in the admin's browser session.