What is GHSA-fvv9-h2vx-4hfq?

GHSA-fvv9-h2vx-4hfq is a security advisory published by GitHub Security Advisories with Medium severity. AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in...

Which CVE IDs does GHSA-fvv9-h2vx-4hfq cover?

GHSA-fvv9-h2vx-4hfq covers the following CVE IDs: CVE-2026-85158. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-fvv9-h2vx-4hfq?

GHSA-fvv9-h2vx-4hfq has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

GHSA-fvv9-h2vx-4hfqMediumCVSS 5.4

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in...

Vendor

GitHub Security Advisories

Published

September 3, 2026

Last Modified

September 3, 2026

🔗 CVE IDs covered (1)

CVE-2026-85158 →

📋 Description

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in videoEmbeded.php that echoes the link parameter inside an HTML comment with zero escaping. Attackers can close the comment with --> and inject arbitrary JavaScript that executes when victims visit the crafted embed URL.

🔗 References (4)

https://github.com/WWBN/AVideo/security/advisories/GHSA-9455-f6vm-29xc
https://nvd.nist.gov/vuln/detail/CVE-2026-85158
https://www.vulncheck.com/advisories/avideo-reflected-xss-via-videoembeded-php-link-parameter
https://github.com/advisories/GHSA-fvv9-h2vx-4hfq