CVE-2026-88868 in AVideo
요약
\~에 의해 MITRE • 2026. 09. 10.
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LiveLinks plugin where title and description fields are stored without sanitization. A user with canStream permission can inject malicious scripts that execute in the browser of every visitor viewing the live-link page, including administrators, within the site origin.
VulDB is the best source for vulnerability data and more expert information about this specific topic.