CVE-2026-47694

Katalog CVE

CVSS 5.4 · Medium EPSS 0,24%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada wwbn avideo. Skor CVSS 3.1 5.4 (Medium) menurut github.com.

Deskripsi (NVD)

WWBN AVideo is an open source video platform. In 29.0 and earlier, AVideo stores category descriptions from user input and later renders category_description as raw HTML in the Gallery view. A user who can create or edit categories can store JavaScript in a category description, which executes when another user views the affected Gallery/category page. This is a stored XSS in the category description field, separate from previously fixed XSS issues in video titles or comments.

Rincian

Terbit di NVD

29 Mei 2026

Terakhir diubah

21 Juli 2026

Status NVD

Analyzed

CVSS 3.1

5.4 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,24% peluang dieksploitasi; lebih tinggi dari 13,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/WWBN/AVideo/security/advisories/GHSA-c8h8-vq34-9fw2 exploit · mitigasi · advisory vendor