CVE-2026-105086 | CyberRota

CyberRota Analysis

AI-Generated

WWBN AVideo versions 12.4 through 29.2.0 are vulnerable to a stored cross-site scripting (XSS) flaw that enables authenticated users to inject malicious HTML into video titles using doubly-encoded entities. This vulnerability can lead to the execution of arbitrary scripts on various pages, including trending and gallery sections, potentially compromising user data and site integrity. Organizations using affected versions should prioritize patching this vulnerability to protect against potential exploitation.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links

github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE

CVE-2026-105086

Severity

HIGH

CVSS

8.7

EPSS

0.23%

Original NVD Description

WWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows authenticated uploaders to inject HTML by submitting doubly-encoded entities in video titles. Because safeString() strips tags before decoding entities and runs twice via setTitle() and save(), attackers can store markup that executes in trending, gallery, embed, and playlist pages.