Cross-site scripting in AVideo - CVE-2026-72747
Published: November 11, 2026
Vulnerability identifier: #VU165926
CSH Severity: High
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-72747
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary JavaScript in an administrator's browser session and disclose sensitive information.
The vulnerability exists due to improper neutralization of input in AVideo's setPhone() method and bootgrid rendering when storing and displaying registration phone values through tbody.html(rows). A remote attacker can solve the registration captcha and submit <img src=x onerror="document.title='Stored_XSS_PoC'"> in the phone field to execute JavaScript when an administrator visits /users.
Affected software
AVideo
How to mitigate CVE-2026-72747
Install security update from vendor's website.
AVideo - update to 29.1.0