CVE-2026-50745
Description
A missing sanitisation vulnerability exists with user input in the stats-video.php script. The way URLs to this script were constructed did not follow best practices, and the output of the Smarty custom helper function url was neither properly encoded nor sanitised, allowing user‑supplied input to be reflected without escaping.
Summary dbcve.org
This is a reflected Cross-Site Scripting (XSS) vulnerability in the stats-video.php script where user-supplied input is reflected without proper sanitization. The Smarty custom helper function 'url' outputs user input without encoding or escaping, allowing malicious scripts to be injected via crafted URLs and executed in victim browsers.
Mitigation
Implement proper output encoding/sanitization in the Smarty template's url helper function to ensure all user-supplied input is escaped before rendering. Apply context-aware encoding based on where the output is being placed (HTML attribute, URL parameter, etc.).