The flaw resides in AVideo’s view templates, where the unlockPassword request parameter is inserted directly into an HTML input tag without any encoding. By inserting a payload that closes the value attribute and adds JavaScript event handlers, an attacker can force the browser to execute code when a victim clicks a crafted link. This is a classic reflected cross‑site scripting vulnerability (CWE‑79) that can compromise a visitor’s session or steal credentials.

The vulnerability affects all community editions of WWBN AVideo, specifically versions 26.0 and earlier. The open source platform’s view/forbiddenPage.php and view/warningPage.php files are responsible for rendering the pages, and the faulty code remains until the patch is applied. No third‑party CPEs were listed beyond the generic AVideo CPE.

The CVSS base score of 6.1 indicates a moderate risk, and the EPSS score of less than 1 % suggests a low chance of current exploitation. The vulnerability is not included in CISA’s KEV catalog. An attacker can exploit it remotely by crafting a URL that supplies a malicious unlockPassword value; the victim must then visit the link. Because the flaw is reflected and unauthenticated, the exploitation effort is low, but the potential impact on confidential user data or session hijacking makes it a priority to address.