Stored Cross-Site Scripting in WWBN AVideo Affects Multiple Versions

CVE-2026-88867

What is CVE-2026-88867?

The WWBN AVideo application is vulnerable to a stored cross-site scripting attack due to inadequate sanitization of user inputs during category creation. Specifically, the 'name' and 'iconClass' POST parameters can be manipulated by any authenticated user with upload permissions. When a category is created with a malicious JavaScript payload, the payload is executed in the browser of any visitor, including administrators, who later views content associated with the compromised category. This vulnerability allows unauthorized actions to be performed on behalf of the session of the victim user.

References