WWBN AVideo up to 29.0 Raw Message notifySubscribers.json.php sendSiteEmail cross site scripting

Summaryinfo

A vulnerability labeled as problematic has been found in WWBN AVideo up to 29.0. Affected by this vulnerability is the function sendSiteEmail of the file objects/notifySubscribers.json.php of the component Raw Message Handler. Executing a manipulation of the argument Message can lead to cross site scripting. This vulnerability is registered as CVE-2026-43876. It is possible to launch the attack remotely. No exploit is available. A patch should be applied to remediate this issue.

Detailsinfo

A vulnerability classified as problematic was found in WWBN AVideo up to 29.0. This vulnerability affects the function sendSiteEmail of the file objects/notifySubscribers.json.php of the component Raw Message Handler. The manipulation of the argument message with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect integrity. CVE summarizes:

WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/notifySubscribers.json.php takes the raw message POST parameter and passes it into sendSiteEmail(), which substitutes it directly into an HTML email template (via str_replace on the {message} placeholder) and renders it with PHPMailer::msgHTML(). There is no HTML sanitization, character escaping, or output encoding on the attacker-controlled message between $_POST['message'] and the rendered email. Any authenticated user with upload permission can therefore broadcast arbitrary HTML — phishing links, tracking pixels, CSS/UI spoofing — to every subscriber on their channel (up to 10,000 recipients per invocation). The email is sent From: the platform's configured contact address and wrapped in the site's official logo and title, so attacker-supplied HTML arrives with the appearance of an official platform communication. Commit https://github.com/WWBN/AVideo/commit/ contains an updated fix.

The advisory is available at github.com. This vulnerability was named CVE-2026-43876 since 05/04/2026. The exploitation appears to be easy. The attack can be initiated remotely. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1059.007 by the MITRE ATT&CK project.

By approaching the search of inurl:objects/notifySubscribers.json.php it is possible to find vulnerable targets with Google Hacking.

Applying the patch 078c4342eb9969a70425a9cdca3eefa7f8a86d53 is able to eliminate this problem. The bugfix is ready for download at github.com.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• WWBN

Name

• AVideo

Version

• 29.0

License

• open-source

Website

• Product: https://github.com/WWBN/AVideo/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion