3 matches found
CVE-2026-61575 AVideo-Encoder vulnerable to stored DOM cross-site scripting through queue titles
AVideo is a video-sharing Platform. Prior to 8.1.0, view/queue.php uses pathinfo on the caller-controlled fileURI and stores its filename through setTitle in encoderqueue.title without neutralization. fileURI is not in the objects/security.php filter lists, and the Login::canUpload capability...
CVE-2026-61575 AVideo-Encoder vulnerable to stored DOM cross-site scripting through queue titles
AVideo is a video-sharing Platform. Prior to 8.1.0, view/queue.php uses pathinfo on the caller-controlled fileURI and stores its filename through setTitle in encoderqueue.title without neutralization. fileURI is not in the objects/security.php filter lists, and the Login::canUpload capability...
CVE-2026-61575: WWBN AVideo-Encoder: AVideo is a video-sharing Platform
AVideo is a video-sharing Platform. Prior to 8.1.0, view/queue.php uses pathinfo on the caller-controlled fileURI and stores its filename through setTitle in encoderqueue.title without neutralization. fileURI is not in the objects/security.php filter lists, and the Login::canUpload capability...