Cross-Site Scripting Vulnerability in WWBN AVideo
CVE-2025-50128

9.6CRITICAL

Key Information:

Vendor

Wwbn

Status
Avideo
Vendor
CVE Published:
24 July 2025

What is CVE-2025-50128?

The vulnerability in WWBN AVideo allows attackers to exploit the videoNotFound 404ErrorMsg parameter through crafted HTTP requests. This leads to potential arbitrary JavaScript execution when a user inadvertently visits a compromised webpage. As a result, sensitive user data may be at risk, and users are advised to employ security best practices to mitigate exposure.

Affected Version(s)

AVideo 14.4

AVideo dev master commit 8a8954ff

References

https://talosintelligence.com/vulnerability_reports/TALOS...

CVSS V3.1

Score:
9.6
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Discovered by Claudio Bozzato of Cisco Talos.
.
CVE-2025-50128 : Cross-Site Scripting Vulnerability in WWBN AVideo