Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-61573— AVideo-Encoder: reflected cross-site scripting in the login interface

Quick assessment

Affected
WWBN AVideo-Encoder
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

AVideo 是一个视频分享平台。在 8.1.0 版本之前，其匿名登录接口会将请求参数原样反射到 HTML 和 JavaScript 中，而未进行输出编码。在 中， 由 中的 原样返回，并直接用于导航和表单属性；同时，该值还会进入 中的单引号 JavaScript 字符串。 未对此进行过滤，而 和 字段仅对单引号进行了过滤，导致双引号和尖括号仍可突破 HTML 属性。此外， 使用 反射 POST 字段时未设置 标志，使得闭合的 标签能够跳出脚本上下文；同时， 将 POST 请求中的 参数存储到会话中，并在 中以未转

CVSS 6.1 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-61573

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
AVideo-Encoder: reflected cross-site scripting in the login interface
Source: CVE Program / CVE List V5
Vulnerability Description
AVideo is a video-sharing Platform. Prior to 8.1.0, the anonymous login interface reflects request values into HTML and JavaScript without output encoding. In `view/index.php`, `webSiteRootURL` is returned verbatim by `Streamer::getStreamerURL()` in `objects/Streamer.php` and reaches navigation and form attributes; it also enters a single-quoted JavaScript string in `view/index.header.php`. It is not filtered by `objects/security.php`, while the `user` and `pass` fields are filtered only for single quotes, leaving double quotes and angle brackets capable of breaking out of their HTML attributes. In addition, `view/index.header.php` reflects POST fields using `json_encode` without `JSON_HEX_TAG`, allowing a closing script tag to break out, and `locale/function.php` stores the POST `lang` value in the session for unescaped reflection in `view/index.php`. An unauthenticated remote attacker who persuades a victim to open a crafted login link can execute arbitrary JavaScript in the encoder's origin. This can read the operator session identifier exposed in inline script, capture login credentials and perform actions as the operator against the encoder and its upstream platform. This issue is fixed in version 8.1.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
WWBN AVideo-Encoder < 8.1.0 -

II. Public POCs for CVE-2026-61573

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-61573

请登录查看更多情报信息。

Other References for CVE-2026-61573 (3)

Same Patch Batch · WWBN · 2026-10-28 · 7 CVEs total

CVE-2026-61567 10.0 CRITICAL AVideo-Encoder: unauthenticated command execution through streamer login trust
CVE-2026-61564 10.0 CRITICAL AVideo-Encoder: unauthenticated installer PHP code injection
CVE-2026-61572 8.6 HIGH AVideo-Encoder: unauthenticated full-response server-side request forgery
CVE-2026-61569 7.5 HIGH AVideo-Encoder: pre-authentication streamer-login SQL injection
CVE-2026-61571 7.3 HIGH AVideo-Encoder: missing authentication on control and status endpoints
CVE-2026-61575 4.7 MEDIUM AVideo-Encoder vulnerable to stored DOM cross-site scripting through queue titles

IV. Related Vulnerabilities

Same product: AVideo-Encoder
Same vendor: WWBN
Same weakness: CWE-79