CVE-2023-48728 — AI Deep Analysis Summary

Q: Who is affected? (Versions/Components)

📦 **Product**: WWBN AVideo (PHP-based video platform). 📅 **Affected Versions**: Specifically **11.6** and **dev master** (commit 3c6bb3ff). 🏢 **Vendor**: WWBN.

Q: Is exploitation threshold high? (Auth/Config)

🔓 **Threshold**: **Low**. 👤 **Auth**: No authentication required (`PR:N`). 🌐 **Access**: Network accessible (`AV:N`). ⚠️ **UI**: Requires User Interaction (`UI:R`) – victim must click a crafted link.

Q: Is there a public Exp? (PoC/Wild Exploitation)

🔓 **Public Exp?**: **Yes**. 📜 **PoC**: Available via ProjectDiscovery Nuclei templates. 🌍 **Wild Exp**: Referenced by Talos Intelligence (TALOS-2023-1883). Active exploitation risk exists.

Q: What if no patch? (Workaround)

🚧 **No Patch?**: Implement WAF rules to block `<script>` tags in `videoName`. 🔒 **Mitigation**: Enforce strict Content Security Policy (CSP). 👀 **Monitor**: Alert on unusual XSS payloads in OpenGraph requests.

Q: Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **HIGH**. 📈 **Priority**: Critical due to CVSS H score and public PoC. ⏳ **Action**: Patch immediately or apply WAF mitigations. Do not ignore.

Updated May 08, 2026 CVSS 9.6 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Reflected Cross-Site Scripting (XSS) in WWBN AVideo. <br>💥 **Consequences**: Arbitrary JavaScript execution in victim's browser. <br>⚠️ **Impact**: High severity (CVSS H).…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: CWE-79 (Improper Neutralization of Input). <br>🔍 **Flaw**: The `functiongetOpenGraph` method fails to sanitize the `videoName` parameter.…

Read full answer (login)

Q3Who is affected? (Versions/Components)

📦 **Product**: WWBN AVideo (PHP-based video platform). <br>📅 **Affected Versions**: Specifically **11.6** and **dev master** (commit 3c6bb3ff). <br>🏢 **Vendor**: WWBN.

Q4What can hackers do? (Privileges/Data)

💻 **Hacker Actions**: Execute arbitrary JavaScript. <br>🔑 **Privileges**: Runs with victim's privileges. <br>📊 **Data Access**: Steal cookies, session tokens, or personal data.…

Read full answer (login)

Q5Is exploitation threshold high? (Auth/Config)

🔓 **Threshold**: **Low**. <br>👤 **Auth**: No authentication required (`PR:N`). <br>🌐 **Access**: Network accessible (`AV:N`). <br>⚠️ **UI**: Requires User Interaction (`UI:R`) – victim must click a crafted link.

Q6Is there a public Exp? (PoC/Wild Exploitation)

🔓 **Public Exp?**: **Yes**. <br>📜 **PoC**: Available via ProjectDiscovery Nuclei templates. <br>🌍 **Wild Exp**: Referenced by Talos Intelligence (TALOS-2023-1883). Active exploitation risk exists.

Q7How to self-check? (Features/Scanning)

🔍 **Self-Check**: Scan for `videoName` parameter in OpenGraph endpoints. <br>🧪 **Test**: Inject `<script>alert(1)</script>` into `videoName`.…

Read full answer (login)

Q8Is it fixed officially? (Patch/Mitigation)

🛡️ **Official Fix**: Update to a patched version. <br>📝 **Note**: The dev master commit `3c6bb3ff` is listed as affected, implying the fix may be in a later commit or requires manual code review.…

Read full answer (login)

Q9What if no patch? (Workaround)

🚧 **No Patch?**: Implement WAF rules to block `<script>` tags in `videoName`. <br>🔒 **Mitigation**: Enforce strict Content Security Policy (CSP). <br>👀 **Monitor**: Alert on unusual XSS payloads in OpenGraph requests.

Q10Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **HIGH**. <br>📈 **Priority**: Critical due to CVSS H score and public PoC. <br>⏳ **Action**: Patch immediately or apply WAF mitigations. Do not ignore.

Continue exploring

Vulnerability detail Full AI analysis (login) WWBN CWE-79