AVideo: HTML Injection in notifySubscribers.json.php Allows Platform-Branded Phishing Emails to Channel Subscribers
Date: 2026-05
Affected: composer/wwbn/avideo
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-43876
CWE: CWE-79
CVSS: 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)

## Summary `objects/notifySubscribers.json.php` takes the raw `message` POST parameter and passes it into `sendSiteEmail()`, which substitutes it directly into an HTML email template (via `str_replace` on the `{message}` placeholder) and renders it with `PHPMailer::msgHTML()`. There is no HTML sanitization, character escaping, or output encoding on the attacker-controlled `message` between `$_POST['message']` and the rendered email. Any authenticated user with upload permission can therefore broadcast arbitrary HTML — phishing links, tracking pixels, CSS/UI spoofing — to every subscriber on their channel (up to 10,000 recipients per invocation). The email is sent From: the platform's configured contact address and wrapped in the site's official logo and title, so attacker-supplied HTML arrives with the appearance of an official platform communication. ## Details **File:** `objects/notifySubscribers.json.php` ```php 10: if (!User::canUpload()) { 11: forbiddenPage('You can not notify'); 12: } 13: forbidIfIsUntrustedRequest('notifySubscribers'); 14: $user_id = User::getId(); 15: // if admin bring all subscribers 16: if (User::isAdmin()) { 17: $user_id = ''; 18: } 19: 20: require_once 'subscribe.php'; 21: setRowCount(10000); ... 23: $Subscribes = Subscribe::getAllSubscribes($user_id); ... 34: $subject = 'Message From Site ' . $config->getWebSiteTitle(); 35: $message = $_POST['message']; 36: 37: $resp = sendSiteEmail($to, $subject, $message); ``` Controls present at t


Mitigations:

Architectural layers (MAESTRO):