Security readout for executives and security teams
Plain-English summary
AVideo/YouPHPTube 10.0 and earlier contains reflected cross-site scripting in the searchPhrase parameter. A remote attacker could target an administrator and, if the attack succeeds, steal session cookies or cause administrator-level actions. No public source in the bundle confirms active exploitation.
Executive priority
Prioritize if the organization hosts AVideo/YouPHPTube, especially internet-facing instances. The issue could enable administrator session theft or unauthorized administrative actions, but source detail is incomplete and no active exploitation is cited.
Technical view
The CVE describes multiple reflected XSS issues in AVideo/YouPHPTube through searchPhrase. The issue affects 10.0 and prior according to the CVE title and description. The source bundle does not provide CVSS, CWE, detailed affected CPEs, or a named fixed version.
Likely exposure
Internet-facing AVideo/YouPHPTube instances running version 10.0 or earlier are the relevant exposure. Risk is highest where administrators use the application from normal browsing environments and session protections are weak.
Exploitation context
The bundle supports remote exploitation through a reflected XSS condition, but does not show confirmed exploitation in the wild. CISA KEV status is false. Treat exploitation as plausible for exposed deployments, not proven active.
Researcher notes
Evidence is limited to the CVE description and Synacktiv reference. The CNA record lists affected metadata as n/a despite naming AVideo/YouPHPTube 10.0 and prior in the title and description. No CVSS, CWE, patch version, or exploitation confirmation is provided.
Mitigation direction
- Identify any AVideo/YouPHPTube deployments and confirm their versions.
- Check vendor or project guidance for the fixed release or official remediation.
- Prioritize remediation for version 10.0 and earlier exposed to the internet.
- Limit administrative access to trusted networks where operationally feasible.
- Review session cookie protections and administrative session handling.
Validation and detection
- Search asset inventory for AVideo or YouPHPTube deployments.
- Confirm whether discovered instances run version 10.0 or earlier.
- Review logs for unusual requests involving the searchPhrase parameter.
- Verify administrative interfaces are not broadly exposed.
- Track vendor advisories or project releases for confirmed remediation details.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-25875 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://synacktiv.com/CVE reference, mitre
- https://www.synacktiv.com/sites/default/files/2021-01/YouPHPTube_Multiple_Vulnerabilities.pdfCVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.