---
id: CVE-2026-72747
title: >-
  AVideo fails to sanitize the phone field during user registration, allowing
  unauthenticated attackers to inject malicious JavaScript that persists in the
  database
summary: >-
  AVideo fails to sanitize the phone field during user registration, allowing
  unauthenticated attackers to inject malicious JavaScript that persists in the
  database. When administrators visit the users management page, the unsanitized
  phon…
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
published: '2026-08-11'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:32:39.347'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-72747'
references:
  - url: >-
      https://github.com/WWBN/AVideo/commit/1adcb75458a3b31058655698a833e8cbde4d0593
    label: disclosure@vulncheck.com
  - url: 'https://github.com/WWBN/AVideo/security/advisories/GHSA-cfvq-r985-84wj'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/avideo-stored-cross-site-scripting-via-unauthenticated-registration
    label: disclosure@vulncheck.com
  - url: 'https://github.com/WWBN/AVideo/security/advisories/GHSA-cfvq-r985-84wj'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00354
epssPercentile: 0.26316
ingestedAt: '2026-09-08T21:11:12.275Z'
---

## Overview

AVideo fails to sanitize the phone field during user registration, allowing unauthenticated attackers to inject malicious JavaScript that persists in the database. When administrators visit the users management page, the unsanitized phone value is rendered via innerHTML, executing the injected script in the admin's browser session.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.