Beveiligingsadvies

CVE-2026-85159

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-09-03 11:22:11

Laatst bijgewerkt 2026-09-05 01:13:34

Toegewezen door VulnCheck

CVSS-score 5.4

Status PUBLISHED

Beschrijving

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php where the cancelUri parameter is echoed in an href attribute after isSafeRedirectURL checks protocol only, not HTML characters. Unauthenticated attackers can inject event handlers via relative URLs with embedded quotes to execute arbitrary JavaScript when users interact with the Cancel button.

← Alle CVE's bekijken Bekijk op cve.org ↗