PT-2026-28625 · Avideo · Avideo

Adrgs · Published 2026-03-27 · Updated 2026-03-31 · CVE-2026-34375

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions AVideo versions up to and including 26.0

Description AVideo is an open source video platform. The YPTWallet Stripe payment confirmation page directly outputs the $ REQUEST['plugin'] parameter into a JavaScript block without proper encoding or sanitization. The plugin parameter is not included in the framework's input filter lists, allowing an attacker to inject arbitrary JavaScript by crafting a malicious URL and sending it to a victim user. Successful exploitation of this cross-site scripting (XSS) issue can lead to the exfiltration of the current user's username and password hash via the User::getUserName() and User::getUserPass() functions.

Recommendations Versions up to and including 26.0 should be updated to a version that includes the fix from commit fa0bc102493a15d79fe03f86c07ab7ca1b5b63e2.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-34375

GHSA-PM37-62G7-P768

Affected Products

Avideo

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34375.json · Exploit
• https://github.com/WWBN/AVideo/commit/fa0bc102493a15d79fe03f86c07ab7ca1b5b63e2 · Patch
• https://github.com/WWBN/AVideo/security/advisories/GHSA-pm37-62g7-p768 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34375 · Security Note
• https://osv.dev/vulnerability/GHSA-pm37-62g7-p768 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-34375 · Vendor Advisory
• https://github.com/WWBN/AVideo · Note
• https://twitter.com/TheHackerWire/status/2037635893578874964 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1s8lx07/resumen_diario_de_vulnerabilidades_31032026 · Reddit Post
• https://twitter.com/CVEnew/status/2037719439727292423 · Twitter Post
• https://twitter.com/infoflowcloud/status/2037720361878315270 · Twitter Post