Vulnerability feed
CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run
| Expand | Severity |
Score |
Advisory |
Title |
Source |
Flags |
Published |
|---|---|---|---|---|---|---|---|
| Medium | 5.1 | CVE-2026-116139 |
WWBN AVideo 26.0 through 29.3.0 contains a stored cross-site scripting vulnerability that allows authenticated commenters to inject JavaScript because markDownToHTML()...
WWBNWWBN AVideo
|
NVD | |||
|
CVE-2026-116139WWBN AVideo 26.0 through 29.3.0 contains a stored cross-site scripting vulnerability that allows authenticated commenters to inject JavaScript because markDownToHTML()...
Executive summaryWWBN AVideo versions 26.0 through 29.3.0 contain a stored cross-site scripting flaw that lets a logged-in user who can post comments inject JavaScript into pages viewed by others. The advisory does not give a severity rating or CVSS score, and it does not state a fixed version or a vendor recommendation beyond the code change shown. Technical summaryThe flaw is stored cross-site scripting caused by the markDownToHTML() function, which renders user comment text. The attacker needs an authenticated account able to post comments, and the victim's browser executes the injected script when the comment is viewed. The advisory excerpt shows a code diff that replaces the previous Parsedown safe-mode handling with a custom class that allows only a and img tags, with href, target, src, class and style attributes filtered. The advisory does not state a fixed version number, a workaround, indicators of compromise, exploitation in the wild, or a CVSS score, and it does not give detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/WWBN/AVideo/commit/f13587c59…9273021d29b869594559 Impact if exploitedConfidentialityLow IntegrityLow AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 5.3 | CVE-2026-114634 |
WWBN AVideo before 29.4.0 contains a blind server-side request forgery vulnerability in getHeaderContentTypeFromURL() because get_headers() follows redirects without...
WWBNWWBN AVideo
|
NVD | |||
|
CVE-2026-114634WWBN AVideo before 29.4.0 contains a blind server-side request forgery vulnerability in getHeaderContentTypeFromURL() because get_headers() follows redirects without...
Executive summaryWWBN AVideo versions before 29.4.0 contain a blind server-side request forgery flaw, where the server can be induced to request internal hosts through a redirect. The advisory does not state a severity rating or CVSS score. The fix in the referenced change makes the server follow redirects manually and re-validate each destination before requesting it. Technical summaryThe flaw is a blind server-side request forgery (SSRF) in getHeaderContentTypeFromURL() in objects/functions.php, caused by get_headers() following HTTP redirects without rechecking the destination. The attacker-controlled value is a videoLink, and the advisory says the URL can be reached through Video::getIncludeType(). The diff adds a manual redirect loop that sets follow_location to 0, re-runs isSSRFSafeURL() on each hop, blocks unsafe redirects with a security log entry, and keeps the previous default limit of 20 requests. The advisory does not state a CVSS score, a workaround, or any detection guidance beyond the logging added in the patch. Exploitation in the wild is not stated. The affected version range is given as before 29.4.0, and the fixed release is not separately named beyond that boundary. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/WWBN/AVideo/commit/2db920d33…a27de44034b0a6c78b05 Impact if exploitedConfidentialityNone IntegrityLow AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 7.0 | CVE-2026-114633 |
WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts to delete or modify administrator accounts
WWBNWWBN AVideo
|
NVD | |||
|
CVE-2026-114633WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts to delete or modify administrator accounts
Executive summaryWWBN AVideo versions before 29.4.0 contain an incorrect authorization flaw that lets delegated Users Admin accounts delete or modify administrator accounts. The advisory text provided does not state a severity rating or CVSS score. The provided text shows code changes that add checks to block this, and the advisory does not describe a separate vendor recommendation beyond applying the fixed code. Technical summaryThe weakness is an incorrect authorization check (CWE class not stated) in which a delegated Users Admin role can delete or edit admin accounts through the user save, user delete, API user delete, and confirmDeleteUser paths. The advisory does not state the attack vector details beyond the delegated Users Admin precondition, nor whether authentication is required beyond that role. Affected versions are stated as before 29.4.0, and the fixed version is not explicitly stated, though the changes reference the 29.4.0 boundary. No workaround is stated. Detection guidance is not stated, although the diff adds security log entries for denied admin deletions. The diff also shows a separate swapUser behavior that the code comments say is intentionally not treated as a vulnerability. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/WWBN/AVideo/commit/9c7cadaee…4b941af1bdaed5668145 Impact if exploitedConfidentialityNone IntegrityHigh AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 5.1 | CVE-2026-114048 |
WWBN AVideo before 24.0 contains a cross-site request forgery vulnerability in legacy endpoints like playlistStatus.php that bypass the .json.php-only autoCSRFGuard() check
WWBNWWBN AVideo
|
NVD | |||
|
CVE-2026-114048WWBN AVideo before 24.0 contains a cross-site request forgery vulnerability in legacy endpoints like playlistStatus.php that bypass the .json.php-only autoCSRFGuard() check
From the advisoryWWBN AVideo before 24.0 contains a cross-site request forgery vulnerability in legacy endpoints like playlistStatus.php that bypass the .json.php-only autoCSRFGuard() check. Attackers can lure logged-in users to a page with an auto-submitting form to make private playlists public, remove playlist videos, or forge video suggestions. Impact if exploitedConfidentialityNone IntegrityLow AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Critical | 9.3 | CVE-2026-105089 |
WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 URL
WWBNWWBN AVideo
|
NVD | |||
|
CVE-2026-105089WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 URL
From the advisoryWWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 URL. The value is rendered unescaped in YouPHPFlix2 templates and channel playlists, letting attackers break out of onclick strings or iframe src attributes to execute JavaScript in victims' browsers. Impact if exploitedConfidentialityHigh IntegrityHigh AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Critical | 9.3 | CVE-2026-105086 |
WWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows authenticated uploaders to inject HTML by submitting doubly-encoded entities in...
WWBNWWBN AVideo
|
NVD | |||
|
CVE-2026-105086WWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows authenticated uploaders to inject HTML by submitting doubly-encoded entities in...
From the advisoryWWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows authenticated uploaders to inject HTML by submitting doubly-encoded entities in video titles. Because safeString() strips tags before decoding entities and runs twice via setTitle() and save(), attackers can store markup that executes in trending, gallery, embed, and playlist pages. Impact if exploitedConfidentialityHigh IntegrityHigh AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 5.1 | CVE-2026-100630 |
AVideo before 29.1.0 contains a stored cross-site scripting vulnerability in the video trailer1 field rendered unsanitized within an inline onclick JavaScript string
WWBNWWBN AVideo
|
NVD | |||
|
CVE-2026-100630AVideo before 29.1.0 contains a stored cross-site scripting vulnerability in the video trailer1 field rendered unsanitized within an inline onclick JavaScript string
From the advisoryAVideo before 29.1.0 contains a stored cross-site scripting vulnerability in the video trailer1 field rendered unsanitized within an inline onclick JavaScript string. Attackers with video upload permission can store HTML entity-encoded payloads that bypass isValidURL() validation and are decoded by the browser to break out of the JavaScript string, executing arbitrary code in any visitor's session including administrators. Impact if exploitedConfidentialityLow IntegrityLow AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||