CVE-2026-85577— AVideo userLogin.php Reflected XSS via error parameter
Quick assessment
Affected
WWBN AVideo
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
通过提交 c91b5975d 引入的 AVideo 版本存在一个反射型跨站脚本（XSS）漏洞，位于 中。未经身份验证的攻击者可以通过闭合 标签（即插入 ）注入任意 JavaScript 代码。攻击者可以构造包含脚本跳出序列（script breakout sequences）的恶意 URL，并通过 参数传递，从而在登录页面的受害者浏览器上下文中执行任意 JavaScript。
Possible ATT&CK Techniques 1 AI
T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-85577
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
AVideo userLogin.php Reflected XSS via error parameter
Source: CVE Program / CVE List V5
Vulnerability Description
AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php that allows unauthenticated attackers to inject arbitrary JavaScript by closing the script tag with </script>. Attackers can craft a malicious URL with an error parameter containing script breakout sequences to execute arbitrary JavaScript in the victim's browser context on the login page.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-85577
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-85577
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-85577 (2)
-
-
🔗 AVideo userLogin.php Reflected XSS via error parameter | Advisories | VulnCheck third-party-advisory
IV. Related Vulnerabilities
Same product: AVideo
-
CVE-2026-86190
WWBN AVideo Broken Access Control via videoViewsInfo hash Pa -
CVE-2026-86189
WWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg -
CVE-2026-86188
AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting -
CVE-2026-86186
AVideo API Rate Limit Bypass via Bot User-Agent Header -
CVE-2026-86187
WWBN AVideo Weak PRNG Password Generation via External Login
Same vendor: WWBN
-
CVE-2026-86190
WWBN AVideo Broken Access Control via videoViewsInfo hash Pa -
CVE-2026-86189
WWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg -
CVE-2026-86188
AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting -
CVE-2026-86187
WWBN AVideo Weak PRNG Password Generation via External Login -
CVE-2026-86186
AVideo API Rate Limit Bypass via Bot User-Agent Header
Same weakness: CWE-79
-
CVE-2026-86197
Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox -
CVE-2026-86188
AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting -
CVE-2026-76573
Pods <= 3.3.9.1 - Authenticated (Contributor+) Stored Cross- -
CVE-2026-83625
Contact Form by Supsystic <= 1.10.2 - Unauthenticated Stored -
CVE-2026-85414
Gallery : FooGallery <= 3.3.2 - Authenticated (Contributor+)
V. Comments for CVE-2026-85577
No comments yet