A stored cross-site scripting vulnerability in WWBN AVideo allows authenticated users with upload permissions to execute malicious JavaScript in the context of other users, posing a severe risk of account takeover.

The application fails to sanitize the name and iconClass parameters in objects/categoryAddNew.json.php, allowing an authenticated user with canUpload permissions to store malicious XSS payloads that execute when viewed by other users, including administrators.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript in the context of a victim's session. Given the CVSS score of 8.7, this is a high-severity issue that could lead to unauthorized actions performed on behalf of administrators, potentially resulting in full system compromise, data theft, or further malicious configuration changes.

Immediate Action: Since no official patch is currently available, administrators should immediately disable the usersCanCreateNewCategories option in the AVideo configuration to prevent the exploitation of this vector.

Proactive Monitoring: Review web application logs for suspicious POST requests to objects/categoryAddNew.json.php and monitor administrative dashboards for anomalous script execution or unauthorized changes to category settings.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict XSS filtering rules to detect and block malicious payloads submitted via the category creation interface.

Public Exploit Available: Unknown.

The severity of this vulnerability necessitates immediate administrative intervention. Because a patch is not yet available, organizations must prioritize disabling the vulnerable functionality to eliminate the attack surface. Security teams should maintain heightened vigilance until a verified vendor update is released and applied to all affected instances.