UpHeron
All vulnerabilities

Servers and applications

CVE-2026-126810

WWBN AVideo 29.1.0 through 29.7.1 Stored XSS via Channel RSS Feed

Severity
Medium 5.1
Published
11 Nov 2026
Last changed
11 Nov 2026
Added to UpHeron
11 Nov 2026
Weakness
Cross-site scripting (CWE-79)
Attack
Over the network · Needs a user account · Needs someone to view a page or file
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Sources
CVE Program

Description

WWBN AVideo 29.1.0 through 29.7.1 contains a stored cross-site scripting vulnerability that allows registered users to inject markup through the channel About field rendered in feed/index.php. Attackers can store an unquoted event-handler payload that bypasses feedHtmlDescription() filtering and executes via rss-style.xsl for any visitor, including administrators, viewing the channel feed.

From the CVE Program.

Affected software

SoftwareAffected versions
AVideoServers and applications · cna:wwbn|avideo
  • From 29.1.0 up to 29.7.1

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-126810