CVE-2026-85577 Details

A reflected cross-site scripting vulnerability has been identified in AVideo versions through commit c91b5975d. The issue resides in userLogin.php, where the application echoes the 'error' parameter from the URL inside a script block. This creates an opportunity for unauthenticated attackers to inject arbitrary JavaScript by closing the script tag with '</script>'. Exploitation involves crafting a malicious URL that includes script breakout sequences, which are then executed in the context of the victim's browser on the login page.

Replace 'addslashes($_GET['error'])' with 'json_encode($_GET['error'])' or 'htmlspecialchars($_GET['error'], ENT_QUOTES|ENT_HTML5)' before outputting in a script context. Alternatively, pass the error via a 'data-*' attribute and read it with JavaScript.