CVE-2026-126806

WWBN AVideo versions 14.3 through 29.7.1 are vulnerable to a stored cross-site scripting (XSS) flaw. The issue arises because the videoDownloadedLink value is stored unescaped via objects/aVideoEncoder.json.php. Attackers can inject scripts by embedding event-handler payloads in the URL host, whi...