EUVD-2026-76051

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in the showAlertMessage function that inserts the raw Referer header into a JavaScript comment without encoding. Attackers can craft a Referer header containing / to close t...

CVE-2026-89239

WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1 ) contains a reflected XSS in the showAlertMessage() function. The function inserts the raw Referer header into a JavaScript comment without encoding, allowing an attacker to supply a Referer value containing */ to break out of ...