CVE-2026-89239

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in the showAlertMessage function that inserts the raw Referer header into a JavaScript comment without encoding. Attackers can craft a Referer header containing / to close t...