CyberRota Analysis
AI-GeneratedThe vulnerability affects the Java-based WWBN AVideo application, specifically the url2Embed.json.php endpoint, which is susceptible to unauthenticated reflected cross-site scripting (XSS). Attackers can exploit this flaw by injecting malicious scripts through specially crafted URLs, potentially allowing them to execute JavaScript in victims' sessions and steal sensitive information like cookies or CSRF tokens. Organizations using WWBN AVideo should prioritize patching this vulnerability to mitigate the risk of session hijacking and data theft.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
WWBN AVideo contains an unauthenticated reflected cross-site scripting vulnerability in the url2Embed.json.php endpoint that allows attackers to inject malicious scripts by supplying URLs with HTML metacharacters. Attackers can mint an encrypted evideo payload containing unescaped markup, then deliver it as a legitimate-looking link on the site's own domain to execute JavaScript in victims' sessions and steal cookies or CSRF tokens.