CVE-2026-105089

critical · 9.3

WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 URL. The value is rendered unescaped in YouPHPFlix2 templates and channel playlists, letting attackers break out of onclick strings or iframe src attributes to execute JavaScript in victims' browsers.

9.3

CVSS

0.3%

EPSS (exploit prob.)

21st

EPSS percentile

2026-10-04

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-79

References

https://github.com/WWBN/AVideo/commit/c4adfde13d1f18e3a415722471efdcd8ab480035
https://github.com/WWBN/AVideo/security/advisories/GHSA-6wfr-c7fw-4xvw
https://www.vulncheck.com/advisories/wwbn-avideo-through-29.2.0-stored-xss-via-trailer1-in-youphpflix2-templates
https://github.com/WWBN/AVideo/security/advisories/GHSA-6wfr-c7fw-4xvw

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-105089