CVE-2026-72747
Last modified
CVE-2026-72747 is a high-severity vulnerability rated 7.2/10 on the CVSS scale. AVideo fails to sanitize the phone field during user registration, allowing unauthenticated attackers to inject malicious JavaScript that persists in the database. When administrators visit the users management page, the unsanitized phone value is rendered via innerHTML, executing the injected script in the admin's browser session.. EPSS estimates a 0.26% chance of exploitation in the next 30 days.
Description
AVideo fails to sanitize the phone field during user registration, allowing unauthenticated attackers to inject malicious JavaScript that persists in the database. When administrators visit the users management page, the unsanitized phone value is rendered via innerHTML, executing the injected script in the admin's browser session.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| WWBN | AVideo | 29.0 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-72747?
How severe is CVE-2026-72747?
How do I fix CVE-2026-72747?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-72741Rainbond through 6.9.7 contains a broken access control vuln…8.1
- CVE-2026-72742DSPy 3.3.0b1 contains a file exfiltration vulnerability in t…8.6
- CVE-2026-72743SQLBot through 1.10.0, fixed in commit c3f40a5, contains a s…5.4
- CVE-2026-72744Nuxt versions >= 4.4.7 and < 4.5.1, and >= 3.21.7 and < 3.21…6.2
- CVE-2026-72745Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2026-72746Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2026-72748AVideo contains an unauthenticated arbitrary file write vuln…9.1
- CVE-2026-72749n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype…6.5
- CVE-2026-72750n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injec…8.8
- CVE-2026-72751CTI-Transmute is affected by a stored cross-site scripting (…5.1
- CVE-2026-72759In affected versions of MISP cti-transmute, the conversion-h…6.9
- CVE-2026-72760Affected versions of MISP cti-transmute disclose users' emai…5.3
Are you affected by CVE-2026-72747?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST