A critical cross-site scripting (XSS) vulnerability in WWBN AVideo 14.4 exposes users to session hijacking and unauthorized script execution, necessitating immediate remediation.

The vulnerability exists in the videosList page parameter, which fails to properly sanitize user-supplied input. An unauthenticated attacker can craft a malicious HTTP request to execute arbitrary code within the browser of a user visiting the affected page.

Successful exploitation allows for the theft of sensitive session cookies, potentially leading to complete account takeover. Given the CVSS score of 9.0, this represents a significant risk to the integrity and confidentiality of the AVideo platform and its users.

Immediate Action: Upgrade to the latest version of AVideo provided by the vendor to ensure the videosList parameter is properly sanitized.

Proactive Monitoring: Review web server and application logs for suspicious HTTP requests containing script tags or encoded payloads directed at the videosList functionality.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block XSS patterns in URL parameters to provide temporary protection.

Public Exploit Available: No

This XSS vulnerability is severe and requires urgent attention to prevent unauthorized access. Administrators should update the software immediately and ensure that all input validation controls are functioning correctly.