Description
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in UserGroups::setGroup_name() that fails to sanitize group_name input. Administrators with canAdminUserGroups permission can inject malicious HTML and JavaScript that executes in the browser when other administrators access the user manager interface.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WWBN | AVideo | — | — |
References
- GitHub Security Advisory (GHSA-qm3h-2jrx-xmg6) vendor-advisory
- VulnCheck Advisory: WWBN AVideo Stored XSS via UserGroups setGroup_name third-party-advisory