CVE-2021-25878
MediumCVSS 6.1Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
AVideo/YouPHPTube 10.0 and prior versions are affected by multiple reflected Cross-Site Scripting (XSS) vulnerabilities via the videoName parameter. This allows a remote attacker to steal administrator session cookies or perform actions as an administrator.
Risk Assessment
The risk involves potential compromise of administrator accounts, which could lead to full system compromise, data theft, or unauthorized configuration changes.
Recommendation
Immediately update AVideo/YouPHPTube to the latest available version that fixes this vulnerability. Additionally, implement input filtering and validation for the videoName parameter.
Original NVD description (English source)
AVideo/YouPHPTube 10.0 and prior is affected by multiple reflected Cross Script Scripting vulnerabilities via the videoName parameter which allows a remote attacker to steal administrators' session cookies or perform actions as an administrator.