https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-12T19:48:05.297962+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-364140 EUVD-2026-364140 2026-10-12T19:48:05.300006+00:00 EUVD-2026-364140 https://cve.radiocsirt.org/vuln/fkie_cve-2026-85159 fkie_cve-2026-85159 2026-10-12T19:48:05.300033+00:00

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php where the cancelUri parameter is echoed in an href attribute after isSafeRedirectURL checks protocol only, not HTML characters. Unauthenticated attackers can inject event handlers via relative URLs with embedded quotes to execute arbitrary JavaScript when users interact with the Cancel button.

 https://cve.radiocsirt.org/vuln/ghsa-gr2c-r9h3-6533 GHSA-gr2c-r9h3-6533 2026-10-12T19:48:05.300063+00:00

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php where the cancelUri parameter is echoed in an href attribute after isSafeRedirectURL checks protocol only, not HTML characters. Unauthenticated attackers can inject event handlers via relative URLs with embedded quotes to execute arbitrary JavaScript when users interact with the Cancel button.