AVideo is a video-sharing Platform. Prior to 8.1.0, "view/queue.php" uses "pathinfo" on the caller-controlled "fileURI" and stores its filename through "setTitle" in "encoder_queue.title" without neutralization. "fileURI" is not in the "objects/security.php" filter lists, and the "Login::canUpload()" capability needed to submit a queue entry can be self-granted using an attacker-controlled login site without legitimate encoder credentials. "view/index.php" loads "queue.json" from "view/queue.json.php" into the "#grid" jQuery Bootgrid table; its title formatter concatenates "row.title" into raw cell HTML. An attacker can therefore store an HTML title whose event handler runs in a privileged viewer's browser. "Encoder::getAll" limits nonadministrators to their own streamer's rows, so the victim must be an administrator who sees all rows or an operator on the attacker's streamer. A second ".html()" sink in the progress panel uses the same title but additionally depends on a helper script loaded from the streamer; the Bootgrid sink is reachable from encoder code alone. The script can read session-visible data and rendered streamer credentials, act with the viewer's privileges, and execute again for each qualifying viewer until the row is removed. This issue is fixed in version 8.1.0.