Cross-Site Scripting Vulnerability in WWBN AVideo by WWBN
CVE-2025-46410

9.6CRITICAL

Key Information:

Vendor

Wwbn

Status
Avideo
Vendor
CVE Published:
24 July 2025

What is CVE-2025-46410?

A cross-site scripting vulnerability exists in the managerPlaylists PlaylistOwnerUsersId parameter of WWBN AVideo 14.4 and the development master commit 8a8954ff. This vulnerability can be exploited when a user is tricked into visiting a malicious webpage, leading to the potential execution of arbitrary JavaScript code within their browser. This could allow attackers to hijack user sessions, steal sensitive information, or perform other malicious actions.

Affected Version(s)

AVideo 14.4

AVideo dev master commit 8a8954ff

References

https://talosintelligence.com/vulnerability_reports/TALOS...

CVSS V3.1

Score:
9.6
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Discovered by Claudio Bozzato of Cisco Talos.
.
CVE-2025-46410 : Cross-Site Scripting Vulnerability in WWBN AVideo by WWBN