Stored Cross-Site Scripting Vulnerability in WWBN AVideo Product

CVE-2026-116139

What is CVE-2026-116139?

The WWBN AVideo product versions 26.0 to 29.3.0 are susceptible to a stored cross-site scripting vulnerability. This flaw permits authenticated commenters to inject malicious JavaScript into the application through comments. The vulnerability arises due to the markDownToHTML() function that inadequately sanitizes event-handler attributes in the leading HTML blocks. Attackers can exploit this by posting a comment that contains an img tag with an onerror handler, circumventing inline sanitization measures. As a result, the injected script could execute in the browsers of users viewing the comments, posing significant security risks.

References