CVE-2026-85159CWE-79cross-site-scripting

CVE-2026-85159

Medium · published September 3, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
20.0
In the wild
Unconfirmed
What it is

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php where the cancelUri parameter is echoed in an href attribute after isSafeRedirectURL checks protocol only, not HTML characters. Unauthenticated attackers can inject event handlers via relative URLs with embedded quotes to execute arbitrary JavaScript when users interact with the Cancel button.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00286 · 20.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-09-03T17:06Z
References (3)
https://github.com/WWBN/AVideo/security/advisories/GHSA-mw3g-2292-vw4c · [email protected]https://www.vulncheck.com/advisories/avideo-reflected-xss-via-canceluri-in-userlogin-php · [email protected]https://github.com/WWBN/AVideo/security/advisories/GHSA-mw3g-2292-vw4c · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 05 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 03 SEP 11:22Z
    AVideo Reflected XSS via cancelUri in userLogin.php
    cvelistv5