AVideo contains a reflected cross‑site scripting flaw in userLogin.php. The cancelUri query parameter is echoed directly into an href attribute after only checking the protocol, allowing an attacker to embed quotes and event handlers in a relative URL. When a visitor clicks the Cancel link, the untrusted JavaScript executes in the victim’s browser, enabling arbitrary code execution, cookie theft, defacement, or further exploitation.

Any AVideo deployment from the WWBN project that includes commit c91b5975d or earlier before the fix. Since no explicit version numbers are specified, all installations that have not applied the latest security update are considered vulnerable. The flaw resides in userLogin.php and affects any user who can access the login page with a crafted cancelUri value.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not available, so the current likelihood of exploitation is unclear. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger it remotely by sending a malicious link that includes a crafted cancelUri parameter, turning social‑engineering or phishing campaigns into effective attack vectors. Because no authentication is required on the victim’s side, any user who follows the link could be compromised, making the overall risk high for exposed installations.