Ameeba Blog Logo
Ameeba Chat App store presentation
Download Ameeba Chat Today
Ameeba Blog Search

CVE-2025-36548: Cross-Site Scripting (XSS) Vulnerability in WWBN AVideo

Ameeba’s Mission: Safeguarding privacy by securing data and communication with our patented anonymization technology.

Overview

This blog post aims to provide an in-depth analysis of the recent vulnerability identified as CVE-2025-36548. This cross-site scripting (XSS) vulnerability affects WWBN AVideo version 14.4 and the dev master commit 8a8954ff. The vulnerability has been reported to exist within the LoginWordPress loginForm cancelUri parameter functionality of the software. As a result, it presents an alarming risk to all users of the affected software, allowing attackers to execute arbitrary Javascript, potentially leading to system compromise or data leakage.

Vulnerability Summary

CVE ID: CVE-2025-36548
Severity: High (8.3 CVSS Score)
Attack Vector: Network
Privileges Required: None
User Interaction: Required
Impact: Potential system compromise or data leakage

Affected Products

Ameeba Chat Icon Escape the Surveillance Era

Most apps won’t tell you the truth.
They’re part of the problem.

Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.

Ameeba Chat gives you a way out.

  • • No phone number
  • • No email
  • • No personal info
  • • Anonymous aliases
  • • End-to-end encrypted

Chat without a trace.

Product | Affected Versions

WWBN AVideo | 14.4 and dev master commit 8a8954ff

How the Exploit Works

The vulnerability is exploited when an attacker crafts a specially designed HTTP request, which is then sent to the vulnerable endpoint. The HTTP request includes malicious Javascript code within the ‘cancelUri’ parameter of the LoginWordPress loginForm function. If a user visits a webpage that sends this request, the malicious Javascript code is executed, triggering the vulnerability.

Conceptual Example Code

The following is a conceptual example of how the vulnerability might be exploited. This example demonstrates a maliciously crafted HTTP request to the vulnerable endpoint.

GET /LoginWordPress/loginForm HTTP/1.1
Host: target.example.com
Content-Type: application/x-www-form-urlencoded
cancelUri=http://malicious.example.com?payload=<script>malicious_code_here</script>

In the above example, if a user visits a webpage that triggers this type of request, the browser would execute the malicious code included within the ` Ameeba Chat