CVE-2026-72747

HighCVSS 7.2/10Last modified Oct 24, 2026

Description

AVideo fails to sanitize the phone field during user registration, allowing unauthenticated attackers to inject malicious JavaScript that persists in the database. When administrators visit the users management page, the unsanitized phone value is rendered via innerHTML, executing the injected script in the admin's browser session.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
WWBN	AVideo	29.0

References

Timeline

Published: Aug 11, 2026
Last modified: Oct 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-727489.1AVideo contains an unauthenticated arbitrary file write vulnerability in the aVideoEncoderChunk.json.php endpoint that allows remote attacke CVE-2026-727496.5n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields (Set) node. The node assigns output CVE-2026-727508.8n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the Snowflake node's Execute Query operation, which interp CVE-2026-727515.1CTI-Transmute is affected by a stored cross-site scripting (XSS) vulnerability in the conversion graph used to visualise converted MISP and CVE-2026-727526.5Routinator runs out of memory when the JSON output is requested many times concurrently. This condition can be triggered maliciously by an a CVE-2026-727538.2When Routinator encounters an RRDP notification file with gaps in the delta entries, it is still accepted and parsed, potentially leading to CVE-2026-727547.5When Routinator encounters a CRL with many entries, it may hang or run out of memory. If Routinator encounters a CRL file with the wrong enc CVE-2026-727553.8Routinator stores a newly-retrieved TA certificate via HTTPS in cache without validation, potentially overwriting a known good TA certificat CVE-2026-727567.5Routinator exits when an rsync URI for a file obtained over RRDP contains a path that cannot be stored on disk, such as too long file names,CVE-2026-727575.3Routinator runs out of open connections on the HTTP server when many connections are opened but never closed, leaving the HTTP server unavai CVE-2026-727587.5When parsing an AS range in Routinator, if the maximum value of the range is smaller than the minimum value of the range, Routinator will ne CVE-2026-727596.9In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an incomplete authorization check. When a histo