Cross-Site Scripting Vulnerability in WWBN AVideo by WWBN
CVE-2025-41420

9.6CRITICAL

Key Information:

Vendor

Wwbn

Status
Avideo
Vendor
CVE Published:
24 July 2025

What is CVE-2025-41420?

A cross-site scripting vulnerability has been identified in the userLogin cancelUri parameter of WWBN AVideo versions 14.4 and the dev master commit 8a8954ff. This flaw allows an attacker to craft a malicious HTTP request capable of executing arbitrary JavaScript. When a user unknowingly visits a compromised webpage, the attacker can exploit this vulnerability to potentially manipulate user sessions and access sensitive information.

Affected Version(s)

AVideo 14.4

AVideo dev master commit 8a8954ff

References

https://talosintelligence.com/vulnerability_reports/TALOS...

CVSS V3.1

Score:
9.6
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Discovered by Claudio Bozzato of Cisco Talos.
.
CVE-2025-41420 : Cross-Site Scripting Vulnerability in WWBN AVideo by WWBN