Vulnerabilities

WWBN AVideo 29.1.0 through 29.7.1 contains a stored cross-site scripting vulnerability that allows registered users to inject markup through the…

WWBN AVideo 29.1.0 through 29.7.1 contains a stored cross-site scripting vulnerability that allows registered users to inject markup through the channel About field rendered in feed/index.php. Attackers can store an unquoted event-handler payload that bypasses feedHtmlDescription() filtering and executes via rss-style.xsl for any visitor, including administrators, viewing the channel feed.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

WWBN

Product

AVideo

CVSS v3.1

5.4 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness

CWE-79

NVD status

Deferred

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-126810 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 25
   CVE NVD 2h ago

   WWBN AVideo 14.3 through 29.7.1 contains a stored cross-site scripting vulnerability that allows uploaders to inject scripts via the…

   CVSS 8.7 CVE-2026-126806 WWBN