CVE-2026-126806
WWBN AVideo 14.3 through 29.7.1 contains a stored cross-site scripting vulnerability that allows uploaders to inject scripts via the videoDo
CVSS
8.7
Alta
EPSS
—
KEV
—
Exploit Today
—
0-100
Publicado: 11 de nov. de 2026 · Última mod.: 11 de nov. de 2026 · CWE-79
Ainda não há histórico EPSS suficiente.
WWBN AVideo 14.3 through 29.7.1 contains a stored cross-site scripting vulnerability that allows uploaders to inject scripts via the videoDownloadedLink value stored unescaped through objects/aVideoEncoder.json.php. Attackers can embed event-handler payloads in the URL host rendered as a Source tag in view/managerVideos_body.php, executing in administrator sessions to install plugin archives containing PHP.
- github.comhttps://github.com/WWBN/AVideo/blob/v29.7.1/objects/functionTags.php#L198-L221
- github.comhttps://github.com/WWBN/AVideo/blob/v29.7.1/view/managerVideos_body.php#L1997-L2011
- github.comhttps://github.com/WWBN/AVideo/commit/da1da205608d57b1e695a7fad8288a2f5f9a0e0f
- github.comhttps://github.com/WWBN/AVideo/security/advisories/GHSA-2qq6-qfcq-jmr9
- www.vulncheck.comhttps://www.vulncheck.com/advisories/wwbn-avideo-14.3-through-29.7.1-stored-xss-via-video-source-tag
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1268105.4 MÉD—
———WWBN AVideo 29.1.0 through 29.7.1 contains a stored cross-site scripting vulnerability that allows registered users to inject markup through the channel About field rendered in feed/index.php. Attackers can store an unquoted event-handler payload that bypasses feedHtmlDescription() filtering and executes via rss-style.xsl for any visitor, including administrators, viewing the channel feed.4hCVE-2026-1268008.7 ALT—
———Hydro @hydrooj/ui-default before 4.59.1 contains a stored cross-site scripting vulnerability that allows registered users to inject script by placing double quotes in language- class tokens within markdown-it-xss.ts. Attackers can store a payload in their profile bio that executes when administrators or other users view it, stealing the non-httpOnly sid session cookie for session hijacking.4hCVE-2026-1267984.7 MÉD—
———NextScan 1.1.0 through 1.2.0 contains a stored cross-site scripting vulnerability in the ns-admin URL asset detail dialog that renders crawled form request bodies (Asset_URL.data) via innerHTML without encoding. Attackers can host crafted forms on crawled sites to store JavaScript that executes when users view asset details, stealing localStorage access tokens to hijack sessions, including administrators.4hCVE-2026-1220957.6 ALT—
———AsiaInfo BSS Platform 9.2 before 9.2.38 has a stored cross-site scripting (XSS) vulnerability in the menu icon upload function. An authenticated user with ordinary application privileges can upload an SVG file containing embedded JavaScript, which is served from the application origin. Normal menu rendering uses an HTML <img> element and does not execute the SVG script; exploitation requires a victim to load the uploaded SVG as a document (by directly navigating to its URL, or via <object>/<iframe>), in which case the script executes under the application origin.5hCVE-2026-1267785.4 MÉD—
———Wallos 4.4.0 before 5.10.3 contains a stored cross-site scripting vulnerability in endpoints/cronjobs/sendnotifications.php that allows registered users to inject scripts via unescaped notification service responses. Attackers can point their Mattermost webhook URL or Web Push endpoint at a controlled server returning JavaScript, which executes in the administrator's session when sendnotifications.php is opened.6hCVE-2026-1267715.4 MÉD—
———OpsTree REMS through 1.0.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts by uploading attachments with spoofed text/html Content-Type. Attackers can upload HTML files named like test.html.pdf that render in the REMS origin via Preview, executing JavaScript in victims' browsers.6h