CyberRota Analysis
AI-GeneratedThe vulnerability affects WWBN AVideo, specifically in the confirmLivePassword.php file, where a reflected cross-site scripting flaw allows attackers to inject malicious scripts by manipulating the REQUEST_URI. This could lead to unauthorized actions executed in the victim's browser, potentially compromising user data and session integrity. Organizations using this software should prioritize remediation to protect against potential exploitation and safeguard user interactions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in confirmLivePassword.php that copies REQUEST_URI into a form action attribute without encoding. Attackers can craft a malicious URL with a quote character to break out of the action attribute and inject event handlers that execute in the victim's browser within the site origin.