SEPTEMBER 15, 2026
Live Feed
Back to database
Case File

CVE-2026-88867

HIGH · CVSS 8.7 EPSS 0.32% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-10 · Last synced 2026-09-15

CyberRota Analysis

AI-Generated

AVideo versions up to commit c3edcc274c389816d434acadac07ee78eaf330c1 are vulnerable to a stored cross-site scripting (XSS) flaw due to improper sanitization of user input in category creation. This allows any authenticated user with upload permissions to inject malicious JavaScript, which can execute in the browsers of visitors, including administrators, potentially leading to unauthorized actions using the victim's session. Organizations using AVideo should prioritize patching this vulnerability, especially those with user-generated content features enabled.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-88867
Severity
HIGH
CVSS
8.7
EPSS
0.32%
Java

Original NVD Description

WWBN AVideo, in versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1, contains a stored cross-site scripting vulnerability. objects/categoryAddNew.json.php passes the POST parameters `name` and `iconClass` to Category::setName() and Category::setIconClass(), which store the values without sanitization (setName only truncates to 45 characters). The category name is later echoed as HTML text and iconClass is echoed into a class attribute in view/modeYoutubeBottom.php and in Gallery cards (plugin/Gallery/functions.php). When the CustomizeUser option usersCanCreateNewCategories is enabled, any authenticated user with canUpload permission (granted by default via self-registration) can create a category containing a JavaScript payload; the payload then executes in the browser of any visitor, including administrators, who views a watch page or gallery entry for a video assigned to that category, allowing actions such as authenticated requests with the victim's session. The issue was unpatched at the time of reporting.