Live › vulnerability › CVE-2026-116139
Go to dashboardWWBN AVideo versions 26.0 through 29.3.0 let an authenticated commenter post a comment that starts with an img tag carrying an onerror handler, because the markdown renderer keeps event-handler attributes. The script runs in the browser of anyone who views the comment, under the application's origin.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Sites running WWBN AVideo from 26.0 through 29.3.0 where users can post comments. Sites on other versions, or where comments are disabled or only staff can post, are not exposed to this flaw. The sources do not name a fixed version.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
WWBN AVideo 26.0 through 29.3.0 contains a stored cross-site scripting vulnerability that allows authenticated commenters to inject JavaScript because markDownToHTML() preserves event-handler attributes in leading HTML blocks. Attackers can post a comment starting with an img tag carrying an onerror handler, which bypasses the inline sanitizer and executes in viewers' browsers under the application origin.
This page as .md · .json · in your agent: get_signal("CVE-2026-116139")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.