AVideo contains a stored cross‑site scripting flaw that allows attackers who can upload videos to embed specially crafted HTML entity–encoded content in the trailer1 field. The payload is rendered inside an inline onclick JavaScript string without proper sanitization. When a victim visits the page, the browser decodes the entities, exits the string context, and executes the arbitrary JavaScript payload, which can run as the visitor’s session and even affect administrators.

The vulnerability affects the WWBN AVideo application. No specific version information is provided, so all deployments of this software are potentially impacted if they expose the trailer1 field and allow video uploads.

The CVSS score of 5.1 indicates a medium severity vulnerability. The EPSS score is not available, and the issue is not listed in the CISA KEV catalogue. Attackers need only the video‑upload permission to inject the payload, so the attack vector is local to authorized upload actions. Gain of arbitrary JavaScript execution in any visitor’s session poses a risk of data theft or phishing but is limited to the client side of the application.