CVE-2026-88869

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting flaw (CWE-79) in the AD_Server plugin's log.php endpoint, which fails to escape the label parameter before storing it. An unauthenticated remote attacker can submit a crafted label value containing HTML and JavaScript, which is saved by the server and later rendered unsanitized in the admin Ad Types report via jQuery's .html(). When an administrator views that report, the injected script runs in the admin's browser session, allowing the attacker to act as that administrator (e.g., steal session cookies or perform privileged actions). Any AVideo deployment running code up to and including the affected commit where the AD_Server plugin is in use is affected. No exploitation is currently known: there is no public proof-of-concept, the issue is not in CISA KEV, and no in-the-wild activity has been reported.

What to do: Update AVideo to a build newer than commit c3edcc274c389816d434acadac07ee78eaf330c1 (pull the latest upstream release/commit), since no fixed version number is specified in the available data. Until patched, restrict access to the AD_Server plugin's log.php endpoint (e.g., via WAF or reverse-proxy rules that sanitize the label parameter) and limit which accounts can open the Ad Types admin report. Review stored label values and admin browser activity for signs of injected scripts.