CVE-2026-84477 in AVideo
Summary
by MITRE • 09/02/2026
AVideo Live_schedule::setTitle() and setDescription() store POST input without sanitization, allowing users with streaming permission to inject malicious scripts. Unauthenticated attackers can access remindMe.php to execute stored XSS payloads in victim browsers without requiring authentication.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified involves a critical cross-site scripting flaw within the AVideo platform's live scheduling functionality, specifically affecting the setTitle and setDescription methods of the Live_schedule class. This security deficiency stems from an insufficient sanitization process where user-supplied input received via HTTP POST requests is stored directly into the application database without adequate validation or encoding. The core technical failure lies in the absence of output encoding when these scheduled titles and descriptions are subsequently rendered to end-users, allowing any script content embedded during submission to persist and execute within the context of a victim's browser session. This represents a classic case of Stored Cross-Site Scripting where malicious payloads are saved on the target server rather than being executed immediately in a single request-response cycle.
The operational impact is significantly amplified by an additional authentication bypass mechanism present in the remindMe.php endpoint. While many stored XSS vulnerabilities require the victim to be logged into the application or possess specific privileges, this particular flaw allows unauthenticated attackers to trigger the execution of malicious scripts simply by directing a user to a crafted URL containing the payload. This means that any individual with streaming permissions can inject these payloads during the scheduling process, and subsequently, any viewer who accesses the remindMe.php page will have their browser execute the injected code without needing prior authentication or session cookies associated with administrative privileges.
From an industry standards perspective, this vulnerability maps directly to CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific nature of storing malicious input for later execution aligns with CWE-80 Stored XSS. Furthermore, the exploitation technique falls under MITRE ATT&CK tactic TA0001 Initial Access and specifically the Tactic T1189 Drive-by Client Side Code Execution or potentially T1059 Command and Scripting Interpreter if the script performs further actions. The lack of input validation on POST data also indicates a failure in CWE-20 Improper Input Validation, which is often a root cause for such injection flaws.
Mitigation strategies must focus on implementing robust input sanitization and output encoding mechanisms across all user-facing endpoints that handle dynamic content. Developers should employ context-aware output encoding to ensure that special characters are properly escaped before being rendered in HTML, JavaScript, or CSS contexts. Additionally, the implementation of a Content Security Policy can help mitigate the impact by restricting the sources from which scripts can be loaded and executed. For immediate remediation, strict validation rules should be applied to all POST parameters related to live scheduling, ensuring that only expected alphanumeric characters and safe formatting are accepted. The remindMe.php endpoint requires an audit to ensure it does not expose sensitive data or execute client-side logic without proper access controls, although the primary fix remains securing the input pipeline at the source of injection within the Live_schedule class methods.