CVE-2026-41061

WWBN AVideo is an open source video platform. In versions 29.0 and below, the "isValidDuration" regex at "objects/video.php:918" uses "/^0-91,2:0-91,2:0-91,2/" without a "$" end anchor, allowing arbitrary HTML/JavaScript to be appended after a valid duration prefix. The crafted duration is stored...