CVE-2023-25314: 
PHP vulnerability analysis and mitigation

A Cross-Site Scripting (XSS) vulnerability was discovered in World Wide Broadcast Network AVideo before version 12.4. The vulnerability was identified in the success parameter of the /user endpoint, which failed to properly sanitize user input (NVD, CVE).

The vulnerability exists due to improper neutralization of input during web page generation in the success parameter to /user endpoint. The CVSS v3.1 score for this vulnerability is 6.1 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. This indicates that the vulnerability can be exploited remotely, requires low attack complexity, needs no privileges, but does require user interaction (NVD).

When successfully exploited, this vulnerability allows attackers to gain access to sensitive information through cross-site scripting attacks. The vulnerability could enable attackers to execute malicious scripts in the context of the user's browser session (NVD).

The vulnerability has been patched in AVideo version 12.4. The fix includes implementing proper HTML sanitization for the success parameter using a cleanHTML function that removes potentially dangerous elements and attributes from user input (GitHub Patch).