CVE-2026-72747 in AVideo
Summary
by MITRE • 08/11/2026
AVideo fails to sanitize the phone field during user registration, allowing unauthenticated attackers to inject malicious JavaScript that persists in the database. When administrators visit the users management page, the unsanitized phone value is rendered via innerHTML, executing the injected script in the admin's browser session.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability represents a critical cross-site scripting flaw that exploits insufficient input validation and output sanitization within the user registration process. The issue occurs when the application fails to properly sanitize the phone field during user registration, creating an entry point for malicious actors to inject persistent JavaScript code into the database. This weakness directly aligns with CWE-79 Cross-Site Scripting which specifically addresses improper sanitization of user-supplied data that gets rendered in web pages without adequate encoding or validation measures.
The technical exploitation pathway begins with an unauthenticated attacker submitting a malformed phone number containing malicious javascript payload during registration. The application accepts this input without proper sanitization and stores it directly in the database. When system administrators subsequently navigate to the user management interface, the application retrieves these stored values and renders them using innerHTML method, which does not perform automatic script escaping. This direct insertion of unsanitized data into the browser context creates an ideal environment for script execution within the administrative session, effectively compromising the privileged user's browser.
The operational impact of this vulnerability extends far beyond simple data corruption or display issues. Administrators who visit the affected page become victims of persistent cross-site scripting attacks, potentially leading to complete account compromise, privilege escalation, and unauthorized access to sensitive system functionality. The attack vector is particularly dangerous because it leverages legitimate administrative workflows, making detection more challenging while providing attackers with elevated privileges within the system. This vulnerability also violates fundamental security principles outlined in the OWASP Top Ten 2017 category A03: Sensitive Data Exposure and aligns with ATT&CK technique T1566.001 Initial Access: Spearphishing Attachment, as it enables attackers to establish a foothold through user registration and then escalate privileges through administrative session compromise.
Mitigation strategies should implement comprehensive input validation and output encoding mechanisms throughout the application's data flow. The phone field validation must enforce strict format requirements while rejecting potentially malicious content including script tags, event handlers, and other XSS vectors. All user-supplied data must be properly encoded before rendering in HTML contexts using appropriate escaping techniques such as HTML entity encoding or context-appropriate sanitization libraries. Additionally, implementing Content Security Policy headers can provide an additional layer of protection against script execution even if other defenses fail. The system should also consider implementing proper access controls and session management to limit the scope of potential damage from compromised administrative accounts, while regular security audits and input validation testing should be conducted to prevent similar vulnerabilities in other application components.