CVE Daily

CVE-2025-53084

A cross-site scripting (xss) vulnerability exists in the videosList page paramet...

Critical CVSS 9.0

Overview

A cross-site scripting (xss) vulnerability exists in the videosList page parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this vulnerability.

CWE: CWE-79 Published: 2025-07-24T16:15:32.497
Risk analysis

This vulnerability is rated 🔴 CRITICAL.

  • CVSS: 9.0 (CRITICAL)
  • Detected tags: xss (tag impact: MODERATE)

Recommended actions:

  • Apply context-aware output encoding.
  • Enable Content-Security-Policy and HttpOnly/SameSite cookies.

Recommended tools

Tags