CVE-2023-48728: critical vulnerability in WWBN AVideo
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
A flaw in AVideo 11.6 allows attackers to inject malicious JavaScript code through a specially crafted request. When a user visits a webpage controlled by the attacker, the code runs in their browser, potentially stealing data or taking actions on their behalf.
Cross-site scripting (XSS) vulnerability in the getOpenGraph videoName functionality of WWBN AVideo 11.6 and dev master. An attacker can inject arbitrary JavaScript via a malicious HTTP request; exploitation requires user interaction (visiting an attacker-controlled webpage). Impact includes arbitrary code execution in the victim's browser context with access to session data and user actions.
In the same product, most dangerous first.