CVE-2021-25875

MediumCVSS 6.1

Published: 01/11/2021(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.83%

53th percentile - higher than 53% of all known CVEs

Summary

AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross-Site Scripting (XSS) vulnerabilities via the searchPhrase parameter. This allows a remote attacker to steal administrators' session cookies or perform actions as an administrator.

Risk Assessment

The risk for the organization includes administrator account takeover, which can lead to unauthorized access to sensitive data, content modification, or further attacks on the infrastructure.

Recommendation

Immediately update AVideo/YouPHPTube to the latest version that fixes this vulnerability. Additionally, implement input filtering and output encoding for the searchPhrase parameter.

Original NVD description (English source)

AVideo/YouPHPTube AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross Script Scripting vulnerabilities via the searchPhrase parameter which allows a remote attacker to steal administrators' session cookies or perform actions as an administrator.