CVE-2026-85577: AVideo userLogin.php Reflected XSS via error parameter
AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php that allows unauthenticated attackers to inject arbitrary JavaScript by closing the script tag with </script>. Attackers can craft a malicious URL with an error parameter containing script breakout sequences to execute arbitrary JavaScript in the victim's browser context on the login page.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker can exploit it without authentication by crafting a URL to userLogin.php with a malicious error parameter. Exploitation requires convincing a victim to open that URL, after which JavaScript executes in the victim's browser on the login page.
What is the potential impact on a victim?
The injected JavaScript runs in the login page's browser context. This can affect the confidentiality and integrity of data accessible to that page in the victim's session.