TI-2023-14639 Aliases CVE-2023-30860 GHSA-xr9h-p2rc-rpqm

WWBN/AVideo stored XSS vulnerability leads to takeover of any user's account, including admin's account

HIGH 70CWE-79Published 2023-05-08 · Updated 2026-02-24

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

WWBN AVideo is an open source video platform. In AVideo prior to version 12.4, a normal user can make a Meeting Schedule where the user can invite another user in that Meeting, but it does not properly sanitize the malicious characters when creating a Meeting Room. This allows attacker to insert malicious scripts. Since any USER including the ADMIN can see the meeting room that was created by the attacker this can lead to cookie hijacking and takeover of any accounts. Version 12.4 contains a patch for this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00706 53rd percentileScored 2026-11-07

Public exploit Yes 2 exploit referencesTagged by NVD

Fix Fixed AVideo (WWBN): 12.4wwbn/avideo (Packagist): 12.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
WWBN	AVideo	before 12.4	12.4	Patch available	CNA
—	wwbn/avideo (Packagist)	before 12.4	12.4	Patch available	GHSA-xr9h-p2rc-rpqm

AVideo VendorWWBN Affected before 12.4 Fixed in 12.4 Patch available CNA
wwbn/avideo (Packagist) Vendor— Affected before 12.4 Fixed in 12.4 Patch available GHSA-xr9h-p2rc-rpqm

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:wwbn:avideo::::::::	before 12.4	Vulnerable	WWBN

cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:* Versions before 12.4 Vulnerable ·WWBN

Remediation

Fix · CNA AVideo (WWBN) Fixed in 12.4
Fix · GHSA-xr9h-p2rc-rpqm wwbn/avideo (Packagist) Fixed in 12.4 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-30860
2026-10-03 Alias added: GHSA-xr9h-p2rc-rpqm

References

Exploit 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2023-30860

Other 1

https://github.com/WWBN/AVideo

TI-2026-29567 Code injection in WWBN AVideo CVSS 3.1CRITICAL 10.0
TI-2026-26095 AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php CVSS 3.1CRITICAL 9.4
TI-2026-25874 Improper access control in WWBN AVideo CVSS 3.1CRITICAL 10.0
TI-2026-25758 AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass) CVSS 3.1CRITICAL 9.8
TI-2024-20951 An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute… CVSS 3.1CRITICAL 9.8
TI-2023-10706 OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4… CVSS 3.1CRITICAL 9.8

See all 189 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences