Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

AVideo video titles can run malicious code

CVE-2026-105086 · published 14 days ago
Summary

In AVideo versions 12.4 through 29.2.0, users who can upload videos can place hidden code in the video title. That code is stored and later runs when anyone views pages such as trending, gallery, embed or playlists, potentially compromising the site. Apply the vendor’s update or ensure titles are properly cleaned to stop this behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
wwbn avideo <= 29.2.0
Original advisory text
WWBN AVideo 12.4 through 29.2.0 Stored XSS via Double-Encoded Video Title
WWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows authenticated uploaders to inject HTML by submitting doubly-encoded entities in video titles. Because safeString() strips tags before decoding entities and runs twice via setTitle() and save(), attackers can store markup that executes in trending, gallery, embed, and playlist pages.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.3 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published4 Oct 2026
Updated15 Oct 2026
First seen4 Oct 2026
Sources
CVE-2026-105086 · NVD
CVE-2026-105086 · MITRE
CVE-2026-105086 · OSV
GHSA-q62w-927x-vhhf · GHSA
Track software like this
Free during beta