CVE-2026-105089 in AVideo
Summary
by MITRE • 10/04/2026
WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 URL. The value is rendered unescaped in YouPHPFlix2 templates and channel playlists, letting attackers break out of onclick strings or iframe src attributes to execute JavaScript in victims' browsers.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/04/2026
The vulnerability identified in WWBN AVideo versions up through 29.2.0 represents a significant security flaw classified as a stored cross-site scripting (XSS) issue. This type of vulnerability is particularly dangerous because the malicious payload is persisted on the target server, ensuring that every user who views the affected content is exposed to the attack without requiring any specific interaction beyond viewing the page. The root cause lies in insufficient input validation and output encoding within the application's handling of video metadata. Specifically, when a user with upload permissions provides a URL for a video trailer1 field, the system fails to properly sanitize or encode this value before storing it in the database. Consequently, when the data is later retrieved and rendered into YouPHPFlix2 templates or channel playlists, the malicious script executes directly within the context of the victim's browser session.
From a technical perspective, the exploitation mechanism relies on breaking out of existing HTML attributes to inject executable JavaScript code. The vulnerability allows attackers to escape from onclick string contexts or iframe src attribute definitions by injecting carefully crafted payloads that terminate the current attribute and introduce new event handlers or script tags. Because the application renders these values unescaped in multiple template locations, an attacker can achieve arbitrary code execution on behalf of any user who accesses the compromised video content. This capability enables a wide range of malicious activities, including session hijacking through cookie theft, credential harvesting via phishing forms injected into the page, and defacement or redirection to external malicious sites. The persistence of this payload means that even if the original uploader is identified and removed, the threat remains active for all subsequent viewers until the database entry is manually cleaned or patched.
The operational impact of this vulnerability extends beyond individual user compromise to potentially affect the integrity and reputation of the entire video hosting platform. Since AVideo is often used by organizations to host educational, corporate, or public content, a successful attack could lead to widespread dissemination of malware or phishing campaigns among unsuspecting users. Furthermore, because the exploit requires only upload permissions rather than administrative access, it lowers the barrier for entry significantly. This aligns with common threat actor strategies where lower-privileged accounts are targeted as initial footholds for broader network compromise. The ability to execute scripts in the context of the application's domain also bypasses same-origin policy protections, allowing attackers to interact seamlessly with other features and APIs available within the AVideo environment.
In terms of industry standards, this vulnerability maps directly to CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. More specifically, it falls under Stored XSS where the malicious script is saved on a server and served to other users later. From an offensive security perspective, such attacks are documented in the MITRE ATT&CK framework under techniques like T1059 Command and Control scripting or potentially T1189 Drive-by Compromise if used for malware delivery. Understanding these mappings helps organizations prioritize remediation efforts based on established risk frameworks and threat intelligence models that track similar exploitation patterns across different software ecosystems.
To mitigate this vulnerability, immediate action should be taken to upgrade WWBN AVideo to a version later than 29.2.0 where the issue has been addressed by developers through improved input sanitization and output encoding mechanisms. For organizations unable to patch immediately due to operational constraints, implementing Web Application Firewall rules can provide temporary protection by detecting and blocking requests containing known XSS payloads in video metadata fields. Additionally, enforcing strict Content Security Policy headers that restrict script execution sources can limit the impact of any successful injection attempts. Administrators should also review user permissions to ensure that upload capabilities are granted only to trusted individuals and consider implementing manual approval workflows for new content submissions to add an additional layer of verification before data is persisted in templates or playlists.