Stored XSS in AVideo User Donation Link Field

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the user 'donationLink' profile field. User::setDonationLink() (objects/user.php) stores the value and save() validates it only with filter_var(..., FILTER_VALIDATE_URL), which accepts strings such as http://evil.example/"onmouseover=alert(document.domain)//, while getDonationLink() applies only strip_tags() and does not encode double quotes. plugin/CustomizeUser/actionButton.php echoes the value unencoded into an <a href="..."> attribute, and that button is included from view/modeYoutubeBottom.php on the watch page when the CustomizeUser option allowDonationLink is enabled. An authenticated user who updates their own profile via objects/userUpdate.json.php can therefore break out of the href attribute and inject an event handler that executes JavaScript in the browser of any visitor—including an administrator—who views the attacker's videos and interacts with (fo

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

WWBN AVideo contains a stored cross-site scripting (CWE-79) vulnerability in the user profile 'donationLink' field that allows attackers to inject malicious JavaScript code. The vulnerability exists because the application's validation uses only filter_var() with FILTER_VALIDATE_URL, which fails to reject crafted URLs containing JavaScript payloads like http://evil.example/"onmouseover=alert(document.domain)//. When the getDonationLink() function retrieves and displays this field, it applies only strip_tags() without proper HTML entity encoding, allowing the malicious script to execute in victims' browsers. This affects any AVideo installation where users can modify their profiles, potentially compromising account credentials, session tokens, or enabling lateral movement within the platform.

Casky's 323 matching skills leverage Claude's extended reasoning to detect the attack chain behind this vulnerability across MITRE ATT&CK's Initial Access (TA0001) and Privilege Escalation (TA0043) tactics. Practitioners using Casky would identify this pattern through reconnaissance of input validation bypasses, detection of insufficient output encoding in template rendering, and behavioral analysis showing stored payload execution on profile page loads. The platform's skill mapping would flag the specific code paths where user input flows from setDonationLink() through getDonationLink() without proper sanitization, enabling practitioners to spot similar validation-to-rendering gaps in their own applications and prioritize remediation before attackers exploit this chain to establish persistence or escalate privileges.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-89253.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-89253

Casky has 323 skills that investigate the attack patterns behind CVE-2026-89253. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn