2 matches found
CVE-2026-49279
WWBN AVideo is an open source video platform. Versions 29.0 and below contain a Stored XSS vulnerability through the autoEvalCodeOnHTML parameter in the MessageSQLite WebSocket Handler. The MessageSQLite.php handler only strips autoEvalCodeOnHTML from $json'msg', but msgToResourceId reads from...
7.7CVSS6.2AI score0.0054EPSS
SaveExploits0References3Affected Software1
CVE-2026-49279: Improper Neutralization of Input During Web Page Generation
WWBN AVideo is an open source video platform. Versions 29.0 and below contain a Stored XSS vulnerability through the autoEvalCodeOnHTML parameter in the MessageSQLite WebSocket Handler. The MessageSQLite.php handler only strips autoEvalCodeOnHTML from $json'msg', but msgToResourceId reads from...
7.7CVSS6.2AI score0.0054EPSS
SaveExploits0References2
20