UpHeron
All posts

Critical vulnerability

Critical cross-site scripting in AVideo (CVE-2026-126806)

Cross-site scripting in AVideo · Servers and applications

CVE-2026-126806

WWBN AVideo 14.3 through 29.7.1 Stored XSS via Video Source Tag

Severity
Critical 9.3
Published
11 Nov 2026
Weakness
Cross-site scripting (CWE-79)
Attack
Over the network · Needs a user account · Needs someone to view a page or file
Attacker can
Read data · Change data

WWBN AVideo 14.3 through 29.7.1 contains a stored cross-site scripting vulnerability that allows uploaders to inject scripts via the videoDownloadedLink value stored unescaped through objects/aVideoEncoder.json.php. Attackers can embed event-handler payloads in the URL host rendered as a Source tag in view/managerVideos_body.php, executing in administrator sessions to install plugin archives containing PHP.

From the CVE Program.
SoftwareAffected versions
AVideoServers and applications
  • From 14.3 up to 29.7.1
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-126806
Everything about CVE-2026-126806

From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.