CVE-2026-85158 Details
Description
AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in videoEmbeded.php that echoes the link parameter inside an HTML comment with zero escaping. Attackers can close the comment with --> and inject arbitrary JavaScript that executes when victims visit the crafted embed URL.
A reflected cross-site scripting vulnerability has been identified in AVideo versions through commit c91b5975d. The issue resides in the videoEmbeded.php file, where the link parameter is echoed into an HTML comment without any escaping. This flaw allows attackers to close the comment with a specific sequence and inject arbitrary JavaScript, which executes when victims access the modified embed URL. The vulnerability is present on a public embed page that facilitates iframe embedding, potentially impacting any site that incorporates the video.
The vulnerability can be addressed by applying htmlspecialchars to the link parameter before outputting it, or by removing the debug comment that echoes the link parameter entirely.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 3, 2026CISA-ADP
Assessed Sep 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WWBN/AVideo/security/advisories/GHSA-9455-f6vm-29xc | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/WWBN/AVideo/security/advisories/GHSA-9455-f6vm-29xc | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/avideo-reflected-xss-via-videoembeded-php-link-parameter | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WWBN AVideo | <= c91b5975d |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 3, 2026 | CVE Modified | CISA-ADP |
| Sep 3, 2026 | New CVE Received | [email protected] |