{"id":"CVE-2026-126806","kind":"vulnerability","aliases":["CVE-2026-126806"],"related":[],"title":"WWBN AVideo: stored XSS lets uploaders run scripts in admin sessions","description":"WWBN AVideo 14.3 through 29.7.1 contains a stored cross-site scripting vulnerability that allows uploaders to inject scripts via the videoDownloadedLink value stored unescaped through objects/aVideoEncoder.json.php. Attackers can embed event-handler payloads in the URL host rendered as a Source tag in view/managerVideos_body.php, executing in administrator sessions to install plugin archives containing PHP.","summary":"AVideo versions 14.3 through 29.7.1 store the videoDownloadedLink value without escaping, so an uploader can plant event-handler script in a URL. When an administrator opens the video manager page, the script runs in their session and can be used to install a PHP plugin archive.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WWBN AVideo","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["avideo","other","php","self-hosted"],"not_affected_if":["no-untrusted-uploaders","version-outside-range"],"how_to_check":"- Check the AVideo version in the installed codebase or admin panel; affected range is `14.3` through `29.7.1`.\n- Review `view/managerVideos_body.php` and `objects/aVideoEncoder.json.php` for unescaped output of videoDownloadedLink.","fix":"- Fixed version: unknown\n- Vendor patch referenced in sources: GitHub patch link (version not stated in the sources given).","status":"open","published_at":"2026-11-11T21:16:44+00:00","first_seen_at":"2026-11-11T21:29:08+00:00","triaged_at":"2026-11-11T21:30:32+00:00","updated_at":"2026-11-11T21:30:32+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-11T21:30:32Z","model":"claude-haiku-5-5","output":{"fix":"- Fixed version: unknown\n- Vendor patch referenced in sources: GitHub patch link (version not stated in the sources given).","reach":"internet","title":"WWBN AVideo: stored XSS lets uploaders run scripts in admin sessions","impact":"high","summary":"AVideo versions 14.3 through 29.7.1 store the videoDownloadedLink value without escaping, so an uploader can plant event-handler script in a URL. When an administrator opens the video manager page, the script runs in their session and can be used to install a PHP plugin archive.","audience":"businesses","category":"other","nicknames":[],"who_cares":["avideo","self-hosted","php"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"admin session hijacked; attacker installs PHP plugin and runs code","analyst_note":"Confirm the fixed version from the GitHub patch and vendor advisory linked in the sources; the sources given do not name it.","how_to_check":"- Check the AVideo version in the installed codebase or admin panel; affected range is `14.3` through `29.7.1`.\n- Review `view/managerVideos_body.php` and `objects/aVideoEncoder.json.php` for unescaped output of videoDownloadedLink.","plain_action":"","product_name":"WWBN AVideo","needs_analyst":true,"not_affected_if":["no-untrusted-uploaders","version-outside-range"],"who_is_affected":"AVideo installations in the affected range where uploaders can set the downloaded-link field and administrators use the video manager page. Sites that do not run AVideo, or that restrict uploads to trusted users, are less exposed. The sources do not state a fixed version.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000788,"input_tokens":4666,"output_tokens":643,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-126806':14A,17A '-2026':13A,16A '14.3':28B,75C '29.7.1':30B,77C 'admin':10A 'administr':51B,120C 'allow':87C 'archiv':72B,125C 'attack':100C 'avideo':2A,19A,20B,26B,74C 'contain':78C,126C 'cross':82C 'cross-sit':81C 'cve':12A,15A 'emb':102C 'escap':36B 'event':43B,104C 'event-handl':42B,103C 'execut':118C 'handler':44B,105C 'host':25B,110C 'inject':90C 'instal':68B,123C 'let':5A 'manag':55B 'objects/avideoencoder.json.php':99C 'open':52B 'page':56B 'payload':106C 'php':22B,70B,127C 'plant':41B 'plugin':71B,124C 'render':111C 'run':7A,59B 'script':8A,45B,58B,84C,91C 'self':24B 'self-host':23B 'session':11A,62B,121C 'site':83C 'sourc':114C 'store':3A,31B,80C,96C 'tag':115C 'unescap':97C 'upload':6A,39B,88C 'url':48B,109C 'use':66B 'valu':34B,95C 'version':27B 'via':92C 'video':54B 'videodownloadedlink':33B,94C 'view/managervideos_body.php':117C 'vulner':85C 'without':35B 'wwbn':1A,18A,73C 'xss':4A","nicknames":[],"mitigations":[],"who_affected":"AVideo installations in the affected range where uploaders can set the downloaded-link field and administrators use the video manager page. Sites that do not run AVideo, or that restrict uploads to trusted users, are less exposed. The sources do not state a fixed version.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["avideo","wwbnavideo"],"ptokens":["avideo","wwbn"],"labels":["avideo","critical","other","php","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126806':14A,17A '-2026':13A,16A 'admin':10A 'avideo':2A,19A 'cve':12A,15A 'let':5A 'run':7A 'script':8A 'session':11A 'store':3A 'upload':6A 'wwbn':1A,18A 'xss':4A","search_b":"'14.3':28B '29.7.1':30B 'administr':51B 'archiv':72B 'avideo':20B,26B 'escap':36B 'event':43B 'event-handl':42B 'handler':44B 'host':25B 'instal':68B 'manag':55B 'open':52B 'page':56B 'php':22B,70B 'plant':41B 'plugin':71B 'run':59B 'script':45B,58B 'self':24B 'self-host':23B 'session':62B 'store':31B 'upload':39B 'url':48B 'use':66B 'valu':34B 'version':27B 'video':54B 'videodownloadedlink':33B 'without':35B","search_c":"'14.3':75C '29.7.1':77C 'administr':120C 'allow':87C 'archiv':125C 'attack':100C 'avideo':74C 'contain':78C,126C 'cross':82C 'cross-sit':81C 'emb':102C 'event':104C 'event-handl':103C 'execut':118C 'handler':105C 'host':110C 'inject':90C 'instal':123C 'objects/avideoencoder.json.php':99C 'payload':106C 'php':127C 'plugin':124C 'render':111C 'script':84C,91C 'session':121C 'site':83C 'sourc':114C 'store':80C,96C 'tag':115C 'unescap':97C 'upload':88C 'url':109C 'valu':95C 'via':92C 'videodownloadedlink':94C 'view/managervideos_body.php':117C 'vulner':85C 'wwbn':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T14:21:03+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126806","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126806","severity":null,"published_at":"2026-11-11T21:16:44+00:00","modified_at":"2026-11-11T21:16:44+00:00","first_seen_at":"2026-11-11T21:29:08+00:00","fetched_at":"2026-11-11T21:29:08+00:00","note":null}],"documents":[{"id":128976,"url":"https://github.com/WWBN/AVideo/commit/da1da205608d57b1e695a7fad8288a2f5f9a0e0f","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":128977,"url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-2qq6-qfcq-jmr9","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-11T14:21:03+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":128978,"url":"https://www.vulncheck.com/advisories/wwbn-avideo-14.3-through-29.7.1-stored-xss-via-video-source-tag","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}