CVE-2025-46410
Published: 24 July 2025
Summary
CVE-2025-46410 is a critical-severity Cross-site Scripting (CWE-79) vulnerability in Wwbn Avideo. Its CVSS base score is 9.6 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 39.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the XSS vulnerability by requiring identification, reporting, and correction of the flaw in the managerPlaylists PlaylistOwnerUsersId parameter.
Prevents arbitrary JavaScript execution by validating and sanitizing inputs to the vulnerable PlaylistOwnerUsersId parameter.
Blocks XSS exploitation by filtering and encoding outputs derived from the PlaylistOwnerUsersId parameter before rendering in the browser.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
XSS enables arbitrary JS execution via crafted request and victim visiting malicious page, directly mapping to drive-by compromise.
NVD Description
A cross-site scripting (xss) vulnerability exists in the managerPlaylists PlaylistOwnerUsersId parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit…
more
a webpage to trigger this vulnerability.
Deeper analysisAI
CVE-2025-46410 is a cross-site scripting (XSS) vulnerability in the managerPlaylists PlaylistOwnerUsersId parameter functionality of WWBN AVideo version 14.4 and the dev master commit 8a8954ff. The flaw allows a specially crafted HTTP request to lead to arbitrary JavaScript execution, classified under CWE-79 with a CVSS v3.1 base score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).
The vulnerability can be exploited by an unauthenticated attacker over the network with low complexity, requiring only user interaction such as visiting a malicious webpage. Successful exploitation enables arbitrary JavaScript execution in the context of the victim's browser, potentially resulting in high confidentiality, integrity, and availability impacts due to the cross-origin scope change.
Details on the vulnerability, including technical analysis, are available in the Talos Intelligence advisory at https://talosintelligence.com/vulnerability_reports/TALOS-2025-2205. No specific patch or mitigation information is detailed in the provided references.
Details
- CWE(s)