The vulnerability resides in the Gallery Category view of WWBN AVideo; the getBackURL GET parameter is rendered directly into an href attribute without encoding, producing a classic reflected cross‑site scripting flaw. An attacker can craft a malicious URL; when a victim clicking the Back button hits the session, defacing the site, or performing other malicious actions under the victim’s authority.

All instances of the WWBN AVideo platform that include commit c3edcc274c389816d434acadac07ee78eaf330c1 and have the SubCategorys feature enabled are affected. No further version granularity is provided by the CVE record.

The CVSS score of 5.3 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to supply a crafted URL and a victim to interact with the Back control; the flaw is reflected and unauthenticated, so it can be triggered by any exposed user who follows a malicious link. Given its moderate impact and lack of authentication barriers, the risk is significant for publicly accessible Gallery instances.