CVE-2026-92584: AVideo through 29.0 Stored Cross-Site Scripting via User-Agent Header
AVideo through 29.0 (current revision e01e41ecc) contains a stored cross-site scripting vulnerability. The unauthenticated view-counter endpoint objects/videoAddViewCount.json.php reaches VideoStatistic::save(), which writes the caller's User-Agent (via getUserAgentInfo(), which returns unrecognized agent strings verbatim) directly into the app column of the videosstatistics table without invoking the sanitizing setter setApp(); normalizeApp() only truncates the value to 45 characters. The video owner's and administrator's statistics page (view/videoViewsInfo.php) renders this field in a DataTables 1.12.1 column with an unescaped renderer, and DataTables assigns cell content using innerHTML, so attacker-supplied HTML is parsed and executed in the privileged user's authenticated session when the statistics page is viewed. No patched version was available at the time of the advisory.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to the stored payload?
Video owners and administrators are exposed when they open the statistics page that displays affected video-view records. The payload executes in the authenticated session of the user viewing that page.
What does an attacker need to do to exploit this issue?
An attacker does not need authentication. They can send a request to the view-counter endpoint with a crafted User-Agent header; the unrecognized header value is stored and later rendered as HTML.
Are default deployments affected?
The vulnerable path is the unauthenticated view-counter endpoint and does not require a special configuration described in the advisory. Any deployment running AVideo through 29.0 where video owners or administrators view the affected statistics page is potentially exposed.
Is a vendor patch available?
No patched version was available at the time of the advisory.
How can administrators determine whether malicious data may already be stored?
Inspect the app column in the videos_statistics table for unexpected or HTML-like User-Agent values, especially entries associated with video-view records. Viewing suspicious values through the affected statistics page may trigger payload execution.