CVE-2021-25878
MediumCVSS 6.1Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
AVideo/YouPHPTube 10.0 and prior versions are affected by multiple reflected Cross-Site Scripting (XSS) vulnerabilities via the videoName parameter. This allows a remote attacker to steal administrator session cookies or perform actions as an administrator.
Risk Assessment
The risk involves potential compromise of administrator accounts, which could lead to full system compromise, data theft, or unauthorized configuration changes.
Recommendation
Immediately update AVideo/YouPHPTube to the latest available version that fixes this vulnerability. Additionally, implement input filtering and validation for the videoName parameter.
Other vulnerabilities in AVideo/YouPHPTube
See all- CVE-2021-25877High
A vulnerability in AVideo/YouPHPTube 10.0 and prior allows insecure file writes. An administrator can write files to the filesystem using flag and code variables in save.php.
- CVE-2021-25876Medium
AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross-Site Scripting (XSS) vulnerabilities via the 'u' parameter. A remote attacker can exploit this to steal administrator session cookies or perform actions as an administrator.
- CVE-2021-25875Medium
AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross-Site Scripting (XSS) vulnerabilities via the searchPhrase parameter. This allows a remote attacker to steal administrators' session cookies or perform actions as an administrator.
- CVE-2021-25874High
A SQL Injection vulnerability in AVideo/YouPHPTube 10.0 and prior allows an unauthenticated remote attacker to inject SQL code via the catName parameter. This enables retrieval of database information, including application password hashes.
Original NVD description (English source)
AVideo/YouPHPTube 10.0 and prior is affected by multiple reflected Cross Script Scripting vulnerabilities via the videoName parameter which allows a remote attacker to steal administrators' session cookies or perform actions as an administrator.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS