CVE-2026-72747

HIGH 7.2

AVideo Stored Cross-Site Scripting via Unauthenticated Registration

CVSS Score

7.2

EPSS Score

0.0%

EPSS Percentile

0th

AVideo fails to sanitize the phone field during user registration, allowing unauthenticated attackers to inject malicious JavaScript that persists in the database. When administrators visit the users management page, the unsanitized phone value is rendered via innerHTML, executing the injected script in the admin's browser session.

CWE	CWE-79
Vendor	wwbn
Product	avideo
Published	Aug 11, 2026

Stay Ahead of the Next One

Get instant alerts for wwbn avideo

Be the first to know when new high vulnerabilities affecting wwbn avideo are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

WWBN / AVideo

29.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/WWBN/AVideo/security/advisories/GHSA-cfvq-r985-84wj github.com: https://github.com/WWBN/AVideo/commit/1adcb75458a3b31058655698a833e8cbde4d0593 vulncheck.com: https://www.vulncheck.com/advisories/avideo-stored-cross-site-scripting-via-unauthenticated-registration

Credits

🔍 DhiyaneshGeek 🔍 neo-ai-engineer