CVE-2026-88869 in AVideo
Summary
by MITRE • 09/10/2026
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the AD_Server plugin's log.php endpoint that fails to escape the label parameter before storage. An unauthenticated attacker can inject malicious HTML through the label parameter, which is later rendered unsanitized in the admin Ad Types report using jQuery .html(), allowing execution of arbitrary JavaScript in an administrator's browser session.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability identified within AVideo versions prior to commit c3edcc274c389816d434acadac07ee78eaf330c1 represents a critical security flaw located specifically in the AD_Server plugin, which is an integral component for managing advertising infrastructure. This vulnerability manifests as a stored cross-site scripting issue centered on the log.php endpoint. The root cause of this weakness lies in the application's failure to properly sanitize or escape user-supplied input before persisting it into the backend storage system. Specifically, the label parameter accepted by the log.php script is processed without adequate validation mechanisms, allowing an attacker to inject malicious content that becomes permanently stored on the server rather than being executed transiently during a single request cycle.
From a technical perspective, this flaw aligns with CWE-79, which categorizes improper neutralization of input during web page generation as cross-site scripting. The severity is amplified by the fact that the injection occurs at the storage layer. When an unauthenticated attacker submits a crafted payload via the label parameter, the application accepts and saves this data without filtering out script tags or event handlers. This stored nature ensures that every subsequent access to the affected functionality will trigger the execution of the injected code, turning what might otherwise be a low-impact reflection issue into a persistent threat vector capable of affecting multiple users over an extended period.
The operational impact is particularly severe due to the specific context in which the malicious payload is rendered. The stored data is later displayed within the admin Ad Types report interface using jQuery's .html() method. Unlike text-based rendering methods that treat content as plain text, .html() interprets the input as HTML markup and executes any embedded scripts immediately upon page load. Consequently, when an administrator views this report, their browser automatically processes the malicious JavaScript contained in the label field. This execution occurs within the security context of the logged-in administrator session, granting the attacker full access to all privileges associated with that administrative account.
This scenario maps directly to MITRE ATT&CK technique T1059.007, which covers command and script interpretation through browser-based scripting languages like JavaScript. By leveraging this vulnerability, an unauthenticated remote actor can achieve arbitrary code execution within the victim's browser environment. The potential consequences include session hijacking, where the attacker steals administrative cookies to impersonate the administrator; credential harvesting by presenting fake login forms that capture sensitive information; or defacement of the administration panel. Furthermore, because the payload is stored server-side, it does not require social engineering tricks like phishing links to be effective against other administrators who simply visit the report page, significantly lowering the barrier for exploitation and increasing the likelihood of successful compromise.
Mitigation strategies must address both immediate remediation and long-term defensive posture improvements. The primary fix involves applying the patch introduced in commit c3edcc274c389816d434acadac07ee78eaf330c1, which implements proper input validation and output encoding for the label parameter within the AD_Server plugin's log.php endpoint. Administrators should ensure that all inputs destined for storage are sanitized using a whitelist approach or robust escaping libraries before being written to the database. Additionally, developers must avoid using jQuery .html() for rendering user-controlled data unless strict Content Security Policy headers and context-aware encoding are employed. Implementing input validation at multiple layers of the application stack provides defense in depth, ensuring that even if one layer fails, subsequent checks can prevent malicious payloads from reaching execution contexts. Regular security audits focusing on stored XSS vectors in administrative interfaces are recommended to identify similar weaknesses before they can be exploited by adversaries seeking persistent access to critical systems.