CVE-2022-30690: critical vulnerability in WWBN AVideo
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A flaw in WWBN AVideo's image403 feature allows attackers to inject malicious JavaScript code into web pages. If a user visits a specially crafted link, their browser could execute the attacker's code, potentially stealing login credentials or sensitive information.
Cross-site scripting (XSS) vulnerability in the image403 endpoint of WWBN AVideo 11.6 and dev master (commit 3f7c0364) allows unauthenticated attackers to inject arbitrary JavaScript through malformed HTTP requests. The attack requires social engineering to trick an authenticated user into triggering the payload, resulting in session hijacking or credential theft.
In the same product, most dangerous first.