Stored Cross-Site Scripting in AVideo by WWBN

CVE-2026-72747

What is CVE-2026-72747?

AVideo has a vulnerability where it does not adequately sanitize the phone field during user registration. This flaw allows unauthenticated attackers to inject malicious JavaScript code that is stored in the database. When administrators access the users management page, the unsanitized phone value is rendered using innerHTML, leading to the execution of the injected script within the admin's browser session. This can compromise the integrity of the web application and potentially lead to further attacks.

References