प्लेटफ़ॉर्म
php
घटक
avideo
में ठीक किया गया
14.4.1
8.0.1
CVE-2025-46410 describes a cross-site scripting (XSS) vulnerability affecting WWBN AVideo versions 14.4 and the dev master branch. This vulnerability allows an attacker to execute arbitrary JavaScript code within a user's browser by crafting a malicious HTTP request. The vulnerability resides in the managerPlaylists PlaylistOwnerUsersId parameter. A fix is available in version 14.4.1.
Successful exploitation of CVE-2025-46410 allows an attacker to inject malicious scripts into webpages viewed by authenticated users of WWBN AVideo. This can lead to a variety of attacks, including session hijacking, credential theft, and defacement of the application. The attacker could potentially gain complete control over the user's session, allowing them to perform actions on behalf of the user without their knowledge. The blast radius extends to any user who interacts with the vulnerable parameter, making it a significant risk for organizations relying on AVideo for content management.
CVE-2025-46410 was publicly disclosed on 2025-07-24. No public proof-of-concept (POC) code has been observed at the time of writing. The vulnerability is not currently listed on the CISA KEV catalog. The CVSS score of 9.6 indicates a critical severity, suggesting a high potential for exploitation if a suitable POC is developed and widely distributed.
Organizations using WWBN AVideo for content management, particularly those with custom integrations or extensions that rely on the managerPlaylists parameter, are at risk. Users with administrative privileges or those who frequently interact with the application are especially vulnerable to exploitation.
• php / web:
grep -r 'managerPlaylists PlaylistOwnerUsersId' /var/www/avideo/• generic web:
curl -I https://your-avideo-instance.com/managerPlaylists?PlaylistOwnerUsersId=<script>alert(1)</script>• generic web:
curl -s https://your-avideo-instance.com/managerPlaylists?PlaylistOwnerUsersId=<script>alert(1)</script> | grep alertdisclosure
एक्सप्लॉइट स्थिति
EPSS
0.10% (28% शतमक)
CISA SSVC
CVSS वेक्टर
The primary mitigation for CVE-2025-46410 is to upgrade to WWBN AVideo version 14.4.1 or later, which includes a fix for the vulnerability. If immediate upgrading is not possible, consider implementing input validation and output encoding on the managerPlaylists PlaylistOwnerUsersId parameter to sanitize user-supplied data. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. Thoroughly review and update any existing security policies to address XSS vulnerabilities.
AVideo को प्रभावित संस्करण के बाद के संस्करण में अपडेट करें। नवीनतम संस्करण और अपडेट निर्देशों के लिए विक्रेता की वेबसाइट देखें। विक्रेता द्वारा प्रदान किए गए सुरक्षा अपडेट को जल्द से जल्द लागू करें।
भेद्यता विश्लेषण और गंभीर अलर्ट सीधे आपके ईमेल में।
CVE-2025-46410 is a critical Cross-Site Scripting (XSS) vulnerability in WWBN AVideo versions 14.4 and dev master, allowing attackers to execute JavaScript code.
If you are using WWBN AVideo version 14.4 or the dev master branch, you are potentially affected by this vulnerability. Upgrade to 14.4.1 to mitigate the risk.
Upgrade to WWBN AVideo version 14.4.1 or later. As a temporary measure, implement input validation and output encoding on the vulnerable parameter.
As of the current date, there are no confirmed reports of active exploitation, but the high CVSS score indicates a significant risk.
Please refer to the WWBN security advisories page for the latest information and official guidance regarding CVE-2025-46410.
अपनी डिपेंडेंसी फ़ाइल अपलोड करें और तुरंत जानें कि यह CVE और अन्य आपको प्रभावित करती हैं या नहीं।