CVE-2026-72747
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
AVideo fails to sanitize the phone field during user registration, allowing unauthenticated attackers to inject malicious JavaScript that persists in the database. When administrators visit the users management page, the unsanitized phone value is rendered via innerHTML, executing the injected script in the admin's browser session.
Risk Assessment
An attacker can hijack an admin session, steal data, or perform unauthorized actions in the AVideo system.
Recommendation
Apply the vendor's patch that sanitizes the phone field, and avoid rendering user data via innerHTML without proper encoding.
Original NVD description (English source)
AVideo fails to sanitize the phone field during user registration, allowing unauthenticated attackers to inject malicious JavaScript that persists in the database. When administrators visit the users management page, the unsanitized phone value is rendered via innerHTML, executing the injected script in the admin's browser session.