CVE-2026-72747

Name of the Vulnerable Software and Affected Versions AVideo (affected versions not specified)

Description An issue exists during user registration where the software fails to sanitize the phone field. This allows unauthenticated attackers to perform a stored cross-site scripting attack by injecting malicious JavaScript that persists in the database. The script executes in the browser session of an administrator when they visit the users management page, as the unsanitized value is rendered using innerHTML.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.