CVE-2025-50128
Published: 24 July 2025
Summary
CVE-2025-50128 is a critical-severity Cross-site Scripting (CWE-79) vulnerability in Wwbn Avideo. Its CVSS base score is 9.6 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked in the top 34.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-50128 is a cross-site scripting (XSS) vulnerability in the videoNotFound 404ErrorMsg parameter functionality of WWBN AVideo version 14.4 and the dev master commit 8a8954ff. The flaw allows a specially crafted HTTP request to lead to arbitrary JavaScript execution and is associated with CWE-79. It carries a CVSS v3.1 base score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), indicating high severity due to network accessibility, low attack complexity, no required privileges, user interaction, changed scope, and high impacts on confidentiality, integrity, and availability. The vulnerability was published on 2025-07-24.
An unauthenticated attacker (PR:N) can exploit this vulnerability by tricking a user into visiting a malicious webpage that sends a crafted HTTP request to the affected AVideo instance. Successful exploitation triggers arbitrary JavaScript execution in the victim's browser context, potentially enabling theft of session cookies, keystroke logging, defacement, or further attacks like account takeover depending on the site's privileges.
Mitigation details are available in the Talos Intelligence advisory at https://talosintelligence.com/vulnerability_reports/TALOS-2025-2207. Security practitioners should consult this report for patch information, workarounds, or configuration changes specific to WWBN AVideo.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-22519
Vulnerability details
A cross-site scripting (xss) vulnerability exists in the videoNotFound 404ErrorMsg parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit…
more
a webpage to trigger this vulnerability.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
XSS enables reflected drive-by JS execution in browser via malicious request triggered by user visit to attacker page; directly maps to T1189 and T1059.007 JavaScript interpreter abuse.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires timely flaw remediation including patching the specific XSS vulnerability in the videoNotFound 404ErrorMsg parameter of AVideo.
SI-15 mandates filtering of information outputs like the 404 error message to prevent injection of arbitrary JavaScript from the crafted parameter.
SI-10 enforces validation of inputs such as the videoNotFound 404ErrorMsg parameter to reject or sanitize XSS payloads before processing.