Stored Cross-Site Scripting in WWBN AVideo by an Authenticated Uploader

CVE-2026-105086

What is CVE-2026-105086?

AVideo versions 12.4 to 29.2.0 feature a stored cross-site scripting vulnerability that allows authenticated users to inject and execute arbitrary HTML. This occurs through doubly-encoded entities in video titles, exploiting the way the application handles input. The function responsible for sanitizing the input overlooks certain encoded characters due to the execution flow, permitting attackers to store and execute custom markup on various user-facing pages including trending, gallery, embed, and playlist views. This can lead to session hijacking, phishing attacks, and other malicious actions affecting users who subsequently view the compromised content.

References