CVE-2026-105086

WWBN AVideo versions 12.4 through 29.2.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability. The flaw exists because the safeString() function strips HTML tags before decoding entities, and since it runs twice via the setTitle() and save() functions, authenticated uploaders can i...