CVE-2021-25876
MediumCVSS 6.1Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross-Site Scripting (XSS) vulnerabilities via the 'u' parameter. A remote attacker can exploit this to steal administrator session cookies or perform actions as an administrator.
Risk Assessment
The risk for the organization includes administrator account takeover, potentially leading to full system compromise, data theft, or content modification.
Recommendation
Immediately update AVideo/YouPHPTube to the latest version and apply input filtering for the 'u' parameter to prevent XSS attacks.
Other vulnerabilities in AVideo/YouPHPTube
See all- CVE-2021-25878Medium
AVideo/YouPHPTube 10.0 and prior versions are affected by multiple reflected Cross-Site Scripting (XSS) vulnerabilities via the videoName parameter. This allows a remote attacker to steal administrator session cookies or perform actions as an administrator.
- CVE-2021-25877High
A vulnerability in AVideo/YouPHPTube 10.0 and prior allows insecure file writes. An administrator can write files to the filesystem using flag and code variables in save.php.
- CVE-2021-25875Medium
AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross-Site Scripting (XSS) vulnerabilities via the searchPhrase parameter. This allows a remote attacker to steal administrators' session cookies or perform actions as an administrator.
- CVE-2021-25874High
A SQL Injection vulnerability in AVideo/YouPHPTube 10.0 and prior allows an unauthenticated remote attacker to inject SQL code via the catName parameter. This enables retrieval of database information, including application password hashes.
Original NVD description (English source)
AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross Script Scripting vulnerabilities via the u parameter which allows a remote attacker to steal administrators' session cookies or perform actions as an administrator.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS