CVE-2022-32770 Cross-site scripting in AVideo

What is CVE-2022-32770?

CVE-2022-32770 is a critical cross-site scripting vulnerability in Wwbn Avideo, published on 22 Aug 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability.This vulnerability arrises from the "toast" parameter which is inserted into the document with insufficient sanitization.

Weakness: CWE-79

Which versions are affected by CVE-2022-32770?

It affects 1 product.

Products include Wwbn Avideo.

How do I fix CVE-2022-32770?

No fix has been published for CVE-2022-32770 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2022-32770 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-32770 exists.

Public exploit code: 1 Nuclei template.

Other vulnerabilities in Wwbn Avideo

• CVE-2026-40911 WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks Critical 10.0
• CVE-2026-33478 AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection Critical 10.0
• CVE-2022-30534 Command injection in AVideo Critical 9.9
• CVE-2022-30547 Path traversal in AVideo Critical 9.9
• CVE-2022-32572 Command injection in AVideo Critical 9.9

All Wwbn Avideo vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-7vp2-4576-rw5v.