{"id":"GHSA-2fch-hv74-fgw9","aliases":[],"title":"Cross site scripting (XSS) in wwbn/avideo","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"HIGH","description":"Description:\n\nWhile making an account in demo.avideo.com I found a parameter \"?success=\" which did not sanitize any symbol character properly which leads to XSS attack.\n\nImpact:\n\nSince there's an Admin account on demo.avideo.com attacker can use this attack to Takeover the admin's account\n\nStep to Reproduce:\n\n1. Click the link below\n\n[https://demo.avideo.com/user?success=\"><img](https://demo.avideo.com/user?success=%22%3E%3Cimg) src=x onerror=alert(document.cookie)>\n\n2. Then XSS will be executed","severity":"high","score":null,"published":"2023-04-26T19:42:30.000Z","modified":"2024-12-03T05:55:29.548Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"wwbn/avideo","sources":[{"name":"OSV · GHSA-2fch-hv74-fgw9","url":"https://osv.dev/vulnerability/GHSA-2fch-hv74-fgw9"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"12.4"}],"type":"ECOSYSTEM"}],"versions":["10.4","10.8","11","11.1","11.1.1","11.5","11.6"],"fixed":["12.4"]}],"sourceAffected":[],"references":["https://github.com/WWBN/AVideo/security/advisories/GHSA-2fch-hv74-fgw9","https://github.com/WWBN/AVideo"],"sources":[{"name":"OSV","id":"GHSA-2fch-hv74-fgw9","modified":"2024-12-03T05:55:29.548295Z","url":"https://osv.dev/vulnerability/GHSA-2fch-hv74-fgw9"}],"assessments":[],"products":[],"remediation":[],"kev":{"status":"unavailable","checkedAt":"2026-10-28T19:15:31.108Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}