CVE-2026-105089

WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 URL. The value is rendered unescaped in YouPHPFlix2 templates and channel playlists, letting attackers break out of oncli...

EUVD-2026-92110

WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 URL. The value is rendered unescaped in YouPHPFlix2 templates and channel playlists, letting attackers break out of oncli...

CVE-2026-105089 WWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHPFlix2 Templates

WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 URL. The value is rendered unescaped in YouPHPFlix2 templates and channel playlists, letting attackers break out of oncli...

CVE-2026-105089

WWBN AVideo versions through 29.2.0 are vulnerable to a stored cross-site scripting (XSS) flaw. The issue arises because the application fails to escape the video trailer1 URL when rendered in YouPHPFlix2 templates and channel playlists. An attacker with upload permissions can inject a malicious ...

CVE-2026-105089 WWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHPFlix2 Templates

WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 URL. The value is rendered unescaped in YouPHPFlix2 templates and channel playlists, letting attackers break out of oncli...

CVE-2026-105089 WWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHPFlix2 Templates

WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 URL. The value is rendered unescaped in YouPHPFlix2 templates and channel playlists, letting attackers break out of oncli...

PT-2026-104642

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 29.2.0 Description A stored cross-site scripting issue exists where users with upload permissions can inject scripts by providing a malicious URL for the video trailer. This value is rendered without proper escaping in...

CVE-2026-105089: Improper Neutralization of Input During Web Page Generation

WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 URL. The value is rendered unescaped in YouPHPFlix2 templates and channel playlists, letting attackers break out of oncli...

CVE-2026-100630

AVideo before 29.1.0 contains a stored cross-site scripting vulnerability in the video trailer1 field rendered unsanitized within an inline onclick JavaScript string. Attackers with video upload permission can store HTML entity-encoded payloads that bypass isValidURL validation and are decoded by...

CVE-2026-100630 AVideo before 29.1.0 Stored XSS via HTML Entity Bypass in trailer1 Field

AVideo before 29.1.0 contains a stored cross-site scripting vulnerability in the video trailer1 field rendered unsanitized within an inline onclick JavaScript string. Attackers with video upload permission can store HTML entity-encoded payloads that bypass isValidURL validation and are decoded by...

CVE-2026-100630 AVideo before 29.1.0 Stored XSS via HTML Entity Bypass in trailer1 Field

AVideo before 29.1.0 contains a stored cross-site scripting vulnerability in the video trailer1 field rendered unsanitized within an inline onclick JavaScript string. Attackers with video upload permission can store HTML entity-encoded payloads that bypass isValidURL validation and are decoded by...

CVE-2026-100630

AVideo contains a stored cross-site scripting (XSS) vulnerability within the video trailer1 field . The issue arises because this field is rendered unsanitized inside an inline onclick JavaScript string . Attackers who possess video upload permissions can inject HTML entity-encoded payloads that ...

EUVD-2026-87724

AVideo contains a stored cross-site scripting vulnerability in the video trailer1 field rendered unsanitized within an inline onclick JavaScript string. Attackers with video upload permission can store HTML entity-encoded payloads that bypass isValidURL validation and are decoded by the browser t...

CVE-2026-100630 AVideo before 29.1.0 Stored XSS via HTML Entity Bypass in trailer1 Field

AVideo before 29.1.0 contains a stored cross-site scripting vulnerability in the video trailer1 field rendered unsanitized within an inline onclick JavaScript string. Attackers with video upload permission can store HTML entity-encoded payloads that bypass isValidURL validation and are decoded by...

PT-2026-99301

Name of the Vulnerable Software and Affected Versions AVideo affected versions not specified Description A stored cross-site scripting issue exists where the video trailer1 field is rendered without proper sanitization inside an inline onclick JavaScript string. Users with video upload permission...

CVE-2026-100630: Improper Neutralization of Input During Web Page Generation

AVideo before 29.1.0 contains a stored cross-site scripting vulnerability in the video trailer1 field rendered unsanitized within an inline onclick JavaScript string. Attackers with video upload permission can store HTML entity-encoded payloads that bypass isValidURL validation and are decoded by...