Cross-Site Scripting Vulnerability in AVideo Admin Panel

CVE-2026-34396

What is CVE-2026-34396?

AVideo, an open-source video platform, contains a security vulnerability that allows attackers to exploit the admin panel. In versions 26.0 and earlier, the plugin configuration values are rendered in HTML forms without proper output encoding, such as htmlspecialchars(). The jsonToFormElements() function in admin/functions.php can be manipulated to include user-controlled values directly into form fields. This weakness enables an attacker, either as a compromised admin or by leveraging a CSRF attack on admin/save.json.php, to inject arbitrary JavaScript code that executes upon any administrator accessing the plugin configuration page. No patches are currently available to mitigate this vulnerability.

References