CyberRota Analysis
AI-GeneratedAVideo's userLogin.php is vulnerable to reflected cross-site scripting due to insufficient validation of the cancelUri parameter, allowing unauthenticated attackers to inject malicious JavaScript through relative URLs. This could lead to unauthorized actions or data exposure when users click the Cancel button. Organizations using AVideo should prioritize patching this vulnerability to protect against potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php where the cancelUri parameter is echoed in an href attribute after isSafeRedirectURL checks protocol only, not HTML characters. Unauthenticated attackers can inject event handlers via relative URLs with embedded quotes to execute arbitrary JavaScript when users interact with the Cancel button.