6 matches found
EUVD-2026-72009
AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other users' browsers via the websocket callback mechanism. Attackers can send crafted socket messages with callback names resolving to global...
CVE-2026-86188
AVideo installations with the YPTSocket plugin enabled are affected by an unauthenticated cross-site scripting (XSS) vulnerability. Attackers can send crafted WebSocket messages whose callback names resolve to global functions such as avideoConfirmHTML, which assign untrusted data to innerHTML, e...
GHSA-8WHC-2WMV-WW35 WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin
Unauthenticated Stored DOM XSS via pagetitle Broadcast in AVideo YPTSocket Plugin Summary A stored DOM Cross-Site Scripting vulnerability CWE-79 in the AVideo YPTSocket plugin lets any unauthenticated remote attacker execute arbitrary JavaScript in the authenticated origin of every administrator...
PT-2026-51364
Name of the Vulnerable Software and Affected Versions AVideo versions prior to 29.0 Description A stored DOM Cross-Site Scripting XSS issue exists in the YPTSocket plugin. An unauthenticated remote attacker can execute arbitrary JavaScript in the authenticated origin of any administrator viewing ...
PT-2026-49154
Unauthenticated Stored DOM XSS via page title Broadcast in AVideo YPTSocket Plugin Summary A stored DOM Cross-Site Scripting vulnerability CWE-79 in the AVideo YPTSocket plugin lets any unauthenticated remote attacker execute arbitrary JavaScript in the authenticated origin of every administrator...