Er is een cross-site scripting (xss) kwetsbaarheid aanwezig in de videosList pagina parameter functionaliteit van WWBN AVideo 14.4 en dev master commit 8a8954ff. Een speciaal opgebouwde HTTP-request kan leiden tot arbitr

The impact of this XSS vulnerability is significant. An attacker could craft a malicious URL containing JavaScript code and trick a user into clicking it. Upon visiting the crafted page, the injected script would execute in the user's browser context, allowing the attacker to steal cookies, session tokens, or redirect the user to a phishing site. The attacker could also modify the content of the page, potentially defacing the website or displaying misleading information. Given the potential for widespread user impact and the ease of exploitation, this vulnerability poses a serious threat to WWBN AVideo deployments.

Organizations and individuals using WWBN AVideo version 14.4 are at immediate risk. Shared hosting environments where multiple users share the same AVideo installation are particularly vulnerable, as an attacker could potentially exploit the vulnerability through another user's account. Users who frequently interact with the videosList page are also at higher risk.

• php: Examine access logs for requests containing suspicious JavaScript code in the videosList parameter. Use grep to search for patterns like <script> or javascript: within the parameter value.

grep 'videosList=[^>]*<script[^>]*' /var/log/apache2/access.log

• generic web: Use curl to test the videosList parameter with a simple JavaScript payload and observe the response for signs of execution (e.g., an alert box).

curl 'http://your-avideo-instance/videosList?videosList=<script>alert("XSS")</script>' -s

1. 2025-07-24Disclosure

   disclosure

1. Gereserveerd2025-06-29
2. Gepubliceerd2025-07-24
3. Gewijzigd2025-11-03
4. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2025-53084 is to immediately upgrade to WWBN AVideo version 14.4.1 or later. If upgrading is not immediately feasible, consider implementing input validation and output encoding on the videosList page parameter to sanitize user-supplied data. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can provide an additional layer of defense. Monitor web server access logs for suspicious requests containing unusual JavaScript code in the videosList parameter.