MEDIUM 5.3 NVD
CVE-2026-85159
AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php where the cancelUri parameter is echoed in an href attr
AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php where the cancelUri parameter is echoed in an href attribute after isSafeRedirectURL checks protocol only, not HTML characters. Unauthenticated attackers can inject event handlers via relative URLs with embedded quotes to execute arbitrary JavaScript when users interact with the Cancel button.
References
- https://github.com/WWBN/AVideo/security/advisories/GHSA-mw3g-2292-vw4c
- https://www.vulncheck.com/advisories/avideo-reflected-xss-via-canceluri-in-userlogin-php
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-09-03 via NVD.
vulnfeed aggregates 7805 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.