PT-2026-44848 · Avideo · Avideo

Proochicken · Published 2026-05-29 · Updated 2026-06-04 · CVE-2026-47694

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions AVideo versions 29.0 and earlier

Description AVideo stores category descriptions from user input and renders the category description variable as raw HTML in the Gallery view. A user with permissions to create or edit categories can inject JavaScript into the description field, which then executes when another user or administrator views the affected Gallery or category page. This stored Cross-Site Scripting (XSS) occurs because the value is rendered without proper output encoding or sanitization in the plugin/Gallery/view/mainAreaCategory.php file. An attacker can use this to perform actions as the victim, steal same-origin data, or abuse administrative UI actions.

Recommendations For versions 29.0 and earlier, sanitize category descriptions on input using the same HTML policy as video descriptions or store them as plain text. Additionally, encode the output using htmlspecialchars() or process the description through HTMLPurifier before storage or rendering.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-47694

GHSA-C8H8-VQ34-9FW2

Affected Products

Avideo

References · 4

• 🔥 https://github.com/WWBN/AVideo/security/advisories/GHSA-c8h8-vq34-9fw2 · Exploit
• https://osv.dev/vulnerability/GHSA-c8h8-vq34-9fw2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-47694 · Security Note
• https://github.com/WWBN/AVideo · Note