UpHeron
All vulnerabilities

Servers and applications

CVE-2026-126806

WWBN AVideo 14.3 through 29.7.1 Stored XSS via Video Source Tag

Severity
Critical 9.3
Published
11 Nov 2026
Last changed
11 Nov 2026
Added to UpHeron
11 Nov 2026
Weakness
Cross-site scripting (CWE-79)
Attack
Over the network · Needs a user account · Needs someone to view a page or file
Attacker can
Read data · Change data
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Sources
CVE Program

Description

WWBN AVideo 14.3 through 29.7.1 contains a stored cross-site scripting vulnerability that allows uploaders to inject scripts via the videoDownloadedLink value stored unescaped through objects/aVideoEncoder.json.php. Attackers can embed event-handler payloads in the URL host rendered as a Source tag in view/managerVideos_body.php, executing in administrator sessions to install plugin archives containing PHP.

From the CVE Program.

Affected software

SoftwareAffected versions
AVideoServers and applications · cna:wwbn|avideo
  • From 14.3 up to 29.7.1

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-126806