https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 09:20:16 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-276873 EUVD-2026-276873 https://cve.radiocsirt.org/vuln/euvd-2026-276873 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33296 <p>WWBN AVideo is an open source video platform. Prior to version 26.0, WWBN/AVideo contains an open redirect vulnerability in the login flow where a user-supplied redirectUri parameter is reflected directly into a JavaScript `document.location` assignment without JavaScript-safe encoding. After a user completes the login popup flow, a timer callback executes the redirect using the unvalidated value, sending the victim to an attacker-controlled site. Version 26.0 fixes the issue.</p> <p>WWBN AVideo is an open source video platform. Prior to version 26.0, WWBN/AVideo contains an open redirect vulnerability in the login flow where a user-supplied redirectUri parameter is reflected directly into a JavaScript `document.location` assignment without JavaScript-safe encoding. After a user completes the login popup flow, a timer callback executes the redirect using the unvalidated value, sending the victim to an attacker-controlled site. Version 26.0 fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-33296 https://cve.radiocsirt.org/vuln/ghsa-hj5h-5623-gwhw <p><strong>Affected:</strong> Packagist: wwbn/avideo</p> <p>### Summary</p> <p>WWBN/AVideo contains an open redirect vulnerability in the login flow where a user-supplied redirectUri parameter is reflected directly into a JavaScript `document.location` assignment without JavaScript-safe encoding. After a user completes the login popup flow, a timer callback executes the redirect using the unvalidated value, sending the victim to an attacker-controlled site.</p> <p>### Details</p> <p>In `view/userLogin.php`, the application accepts a redirectUri GET parameter, passes it through a function called `isSafeRedirectURL()`, and stores the result in $safeRedirectUri. This value is then embedded into an inline JavaScript block:</p> <p>```php var logintimer = setInterval(function() { if (win.closed) { clearInterval(logintimer); document.location = &#34;&lt;?php print $safeRedirectUri; ?&gt;&#34;; } }, 1000); ```</p> <p>The value is printed directly into a JavaScript string literal with no call to `json_encode()`, `htmlspecialchars()`, or any JavaScript-context escaping. Even if `isSafeRedirectURL()` is intended to filter dangerous values, protocol-relative URLs such as `//evil.com` satisfy many naive URL validation checks because they carry no explicit scheme, yet browsers will resolve them as `https://evil.com` when embedded in a navigation target. Additional bypass vectors include subdomain confusion of the form `https://trusted.com.evil.com` and path-prefix matching weaknesses. Because the reflected value lands inside a JavaScript string rather than an HTML at…</p> <p><strong>Affected:</strong> Packagist: wwbn/avideo</p> <p>### Summary</p> <p>WWBN/AVideo contains an open redirect vulnerability in the login flow where a user-supplied redirectUri parameter is reflected directly into a JavaScript `document.location` assignment without JavaScript-safe encoding. After a user completes the login popup flow, a timer callback executes the redirect using the unvalidated value, sending the victim to an attacker-controlled site.</p> <p>### Details</p> <p>In `view/userLogin.php`, the application accepts a redirectUri GET parameter, passes it through a function called `isSafeRedirectURL()`, and stores the result in $safeRedirectUri. This value is then embedded into an inline JavaScript block:</p> <p>```php var logintimer = setInterval(function() { if (win.closed) { clearInterval(logintimer); document.location = &#34;&lt;?php print $safeRedirectUri; ?&gt;&#34;; } }, 1000); ```</p> <p>The value is printed directly into a JavaScript string literal with no call to `json_encode()`, `htmlspecialchars()`, or any JavaScript-context escaping. Even if `isSafeRedirectURL()` is intended to filter dangerous values, protocol-relative URLs such as `//evil.com` satisfy many naive URL validation checks because they carry no explicit scheme, yet browsers will resolve them as `https://evil.com` when embedded in a navigation target. Additional bypass vectors include subdomain confusion of the form `https://trusted.com.evil.com` and path-prefix matching weaknesses. Because the reflected value lands inside a JavaScript string rather than an HTML at…</p> https://cve.radiocsirt.org/vuln/ghsa-hj5h-5623-gwhw