What’s Vulnerable › Vulnerabilities

CVE-2026-85159: AVideo Reflected XSS via cancelUri in userLogin.php

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-03 · updated 2026-09-08
• Weakness: CWE-79

Description

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php where the cancelUri parameter is echoed in an href attribute after isSafeRedirectURL checks protocol only, not HTML characters. Unauthenticated attackers can inject event handlers via relative URLs with embedded quotes to execute arbitrary JavaScript when users interact with the Cancel button.

References

• https://github.com/WWBN/AVideo/security/advisories/GHSA-mw3g-2292-vw4c
• https://www.vulncheck.com/advisories/avideo-reflected-xss-via-canceluri-in-userlogin-php
• https://github.com/WWBN/AVideo/security/advisories/GHSA-mw3g-2292-vw4c

Get alerted when CVE-2026-85159 or the next vulnerability affects your stack