A stored cross-site scripting vulnerability in WWBN AVideo allows authenticated administrators to execute malicious scripts, posing a high risk to administrative session integrity.

This is a stored cross-site scripting (XSS) flaw occurring within the UserGroups::setGroup_name() method, caused by a failure to sanitize the group_name input. The attack requires an authenticated user with the canAdminUserGroups capability to trigger the payload, which then executes in the browser of other administrators viewing the user manager interface.

Successful exploitation allows an attacker with administrative privileges to execute arbitrary JavaScript in the context of other administrators' sessions. This can lead to unauthorized account takeover, sensitive data exfiltration, or the modification of application settings. Given the CVSS score of 8.1, this represents a significant risk to the integrity and confidentiality of the AVideo management platform.

Immediate Action: Monitor the official GitHub repository for a patched commit or release and apply it as soon as it becomes available.

Proactive Monitoring: Review web access logs for unusual activity within the user management interface and monitor for suspicious script injection patterns in HTTP requests targeting the group management endpoints.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the sources from which scripts can be executed, and utilize a Web Application Firewall (WAF) to filter malicious payloads in input fields.

Public Exploit Available: No (the available data confirms no weaponized exploit or public proof-of-concept repository).

Organizations utilizing AVideo should treat this vulnerability with high priority, as it permits lateral movement and privilege escalation between administrative accounts. Administrators must restrict access to the user management functions to trusted personnel only until a vendor-supplied patch is successfully deployed.