वीडियोNotFound 404ErrorMsg पैरामीटर कार्यक्षमता में एक क्रॉस-साइट स्क्रिप्टिंग (XSS) भेद्यता मौजूद है WWBN AVideo 14.4 और dev मास्टर कमिट 8a8954ff में। एक विशेष रूप से तैयार किया गया HTTP अनुरोध ले जा सकता है

This XSS vulnerability poses a significant risk because it allows attackers to inject malicious scripts into web pages viewed by authenticated users of WWBN AVideo. An attacker could craft a malicious HTTP request, enticing a user to visit a webpage containing the exploit. Upon visiting the page, the injected script would execute in the user's browser, potentially stealing session cookies, redirecting the user to a phishing site, or modifying the content of the page. The impact extends beyond simple defacement; attackers could gain complete control over user accounts and potentially access sensitive data stored within the AVideo system. The severity is heightened by the potential for widespread exploitation if the vulnerability is easily discoverable and exploitable.

Organizations using WWBN AVideo version 14.4, particularly those with publicly accessible video streaming services, are at significant risk. Shared hosting environments where multiple users share the same AVideo instance are especially vulnerable, as an attacker could potentially compromise other users' accounts through this vulnerability.

• php: Examine access logs for requests containing suspicious payloads in the videoNotFound parameter. Use grep to search for patterns indicative of XSS attempts.

grep 'videoNotFound=[^a-zA-Z0-9]*' access.log

• generic web: Use curl to test the affected endpoint with a simple XSS payload and observe the response for signs of script execution.

curl 'http://your-avideo-site.com/?videoNotFound=<script>alert(1)</script>'

• generic web: Check response headers for Content-Security-Policy (CSP) directives. Absence or weak CSP configurations increase the risk.

1. 2025-07-24Disclosure

   disclosure

1. आरक्षित2025-06-29
2. प्रकाशित2025-07-24
3. संशोधित2025-11-03
4. EPSS अद्यतन2026-03-23

The primary mitigation for CVE-2025-50128 is to immediately upgrade to version 14.4.1 or later, which contains the fix. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to filter requests containing suspicious patterns in the videoNotFound 404ErrorMsg parameter. Carefully review and sanitize all user-supplied input before rendering it in HTML. Implement strict Content Security Policy (CSP) headers to restrict the sources from which scripts can be executed. After upgrading, confirm the fix by attempting to trigger the vulnerability with a known malicious payload and verifying that the script is not executed.