TI-2022-14315 Aliases CVE-2022-32772 GHSA-578g-7pcp-xjj4

Cross-site scripting in WWBN AVideo

LOW 36CWE-79Published 2022-08-22 · Updated 2025-04-15

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability.This vulnerability arrises from the "msg" parameter which is inserted into the document with insufficient sanitization.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.04048 90th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
WWBN	AVideo	11.6; dev master commit 3f7c0364	—	No fix listed	CNA

AVideo VendorWWBN Affected 11.6; dev master commit 3f7c0364 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:wwbn:avideo:11.6:::::::*	11.6	Vulnerable	WWBN

cpe:2.3:a:wwbn:avideo:11.6:*:*:*:*:*:*:* Versions 11.6 Vulnerable ·WWBN

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2022-32772
2026-10-03 Alias added: GHSA-578g-7pcp-xjj4

References

Advisory 2

TI-2026-29567 Code injection in WWBN AVideo CVSS 3.1CRITICAL 10.0
TI-2026-26095 AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php CVSS 3.1CRITICAL 9.4
TI-2026-25874 Improper access control in WWBN AVideo CVSS 3.1CRITICAL 10.0
TI-2026-25758 AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass) CVSS 3.1CRITICAL 9.8
TI-2024-20951 An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute… CVSS 3.1CRITICAL 9.8
TI-2023-10706 OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4… CVSS 3.1CRITICAL 9.8

See all 189 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences