CRITICAL 9.3 NVD
CVE-2026-105086
WWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows authenticated uploaders to inject HTML by submitting doubly-enc
WWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows authenticated uploaders to inject HTML by submitting doubly-encoded entities in video titles. Because safeString() strips tags before decoding entities and runs twice via setTitle() and save(), attackers can store markup that executes in trending, gallery, embed, and playlist pages.
References
- https://github.com/WWBN/AVideo/commit/c4b6ca95a0ae3efa09919a98879870086cff150e
- https://github.com/WWBN/AVideo/security/advisories/GHSA-q62w-927x-vhhf
- https://www.vulncheck.com/advisories/wwbn-avideo-12.4-through-29.2.0-stored-xss-via-double
This critical severity vulnerability with a CVSS score of 9.3 was published on 2026-10-04 via NVD.
Risk Timeline
CVE Disclosed2026-10-04 · -1 days ago
Remediation Resources
vulnfeed aggregates 10549 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.