Vulnerabilities

WWBN AVideo 14.3 through 29.7.1 contains a stored cross-site scripting vulnerability that allows uploaders to inject scripts via the…

WWBN AVideo 14.3 through 29.7.1 contains a stored cross-site scripting vulnerability that allows uploaders to inject scripts via the videoDownloadedLink value stored unescaped through objects/aVideoEncoder.json.php. Attackers can embed event-handler payloads in the URL host rendered as a Source tag in view/managerVideos_body.php, executing in administrator sessions to install plugin archives containing PHP.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

WWBN

Product

AVideo

CVSS v3.1

8.7 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Weakness

CWE-79

NVD status

Deferred

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-126806 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 18
   CVE NVD 2h ago

   WWBN AVideo 29.1.0 through 29.7.1 contains a stored cross-site scripting vulnerability that allows registered users to inject markup through the…

   CVSS 5.4 CVE-2026-126810 WWBN