CyberRota Analysis
AI-GeneratedAVideo's userLogin.php is vulnerable to reflected cross-site scripting, allowing unauthenticated attackers to inject arbitrary JavaScript by exploiting a flaw in how script tags are handled. This could lead to unauthorized actions executed in the victim's browser context, potentially compromising user data and session integrity. Organizations using AVideo should prioritize patching this vulnerability to safeguard against potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php that allows unauthenticated attackers to inject arbitrary JavaScript by closing the script tag with </script>. Attackers can craft a malicious URL with an error parameter containing script breakout sequences to execute arbitrary JavaScript in the victim's browser context on the login page.