CyberRota Analysis
AI-GeneratedThe LoginControl plugin in AVideo is vulnerable to a stored cross-site scripting (XSS) attack due to improper HTML encoding of PGP public keys in a textarea element. This flaw allows authenticated attackers to inject malicious JavaScript, which executes in an administrator's session when the profile is viewed, potentially leading to unauthorized actions or data exposure. Organizations using AVideo should prioritize patching this vulnerability to protect against potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to HTML-encode PGP public keys echoed into a textarea element. An authenticated attacker can inject malicious JavaScript by submitting a crafted public key, which executes in an administrator's session when viewing the user's profile tab.