CVE-2026-105089
WWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHPFlix2 Templates
- State
- Published
- Severity
- 9.3 Critical
- Published
- Oct 4, 2026
- Updated
- Oct 6, 2026
- Reserved
- Oct 3, 2026
Description
WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 URL. The value is rendered unescaped in YouPHPFlix2 templates and channel playlists, letting attackers break out of onclick strings or iframe src attributes to execute JavaScript in victims' browsers.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N | VulnCheck |
| 3.1 | 8.7 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N | VulnCheck |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
AVideoWWBN |
|
References
- GitHub Security Advisory (GHSA-6wfr-c7fw-4xvw)vendor-advisory
- Patch Commitpatch
- VulnCheck Advisory: WWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHPFlix2 Templatesthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.