XSS Vulnerability in WWBN AVideo Due to Insecure Input Handling
CVE-2026-34739

6.1MEDIUM

Key Information:

Vendor

Wwbn

Status
Avideo
Vendor
CVE Published:
31 March 2026

What is CVE-2026-34739?

The WWBN AVideo platform has a vulnerability that allows for Cross-Site Scripting (XSS) attacks due to improper handling of user input in the User_Location plugin. Specifically, the testIP.php page directly reflects the user-supplied IP request parameter into an HTML input element, without proper encoding. This flaw permits an attacker to inject malicious HTML and JavaScript code through a crafted URL. Even though access to this page is limited to administrator users, the SameSite=None cookie configuration of AVideo facilitates cross-origin exploitation. Consequently, an attacker can deceive an admin into clicking a harmful link that executes the injected JavaScript within the context of their authenticated session, compromising the integrity of the application. As of now, no public patches are available to address this vulnerability.

Affected Version(s)

AVideo <= 26.0

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-j...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.