CyberRota Analysis
AI-GeneratedAVideo contains a reflected cross-site scripting vulnerability in the videoEmbeded.php file, allowing attackers to inject arbitrary JavaScript by manipulating the link parameter without proper escaping. This could lead to unauthorized actions or data exposure when users visit the crafted embed URL. Organizations using AVideo should prioritize patching this vulnerability to protect their users from potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in videoEmbeded.php that echoes the link parameter inside an HTML comment with zero escaping. Attackers can close the comment with --> and inject arbitrary JavaScript that executes when victims visit the crafted embed URL.