CVE-2021-25876
MediumCVSS 6.1Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross-Site Scripting (XSS) vulnerabilities via the 'u' parameter. A remote attacker can exploit this to steal administrator session cookies or perform actions as an administrator.
Risk Assessment
The risk for the organization includes administrator account takeover, potentially leading to full system compromise, data theft, or content modification.
Recommendation
Immediately update AVideo/YouPHPTube to the latest version and apply input filtering for the 'u' parameter to prevent XSS attacks.
Original NVD description (English source)
AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross Script Scripting vulnerabilities via the u parameter which allows a remote attacker to steal administrators' session cookies or perform actions as an administrator.