CVE-2026-89241

WWBN AVideo Reflected XSS via confirmLivePassword.php

Published Sep 11, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in confirmLivePassword.php that copies REQUEST_URI into a form action attribute without encoding. Attackers can craft a malicious URL with a quote character to break out of the action attribute and inject event handlers that execute in the victim's browser within the site origin.

Analysis

Technical impact

WWBN AVideo includes a reflected cross‑site scripting flaw in the confirmLivePassword.php page. The code copies REQUEST_URI can embed a quote character in a malicious URL to break out of the attribute context and inject JavaScript event handlers that run in the victim’s browser while staying within the site origin. The weakness maps to CWE‑79, a vulnerability that allows attackers to execute client‑side scripts in the context of the affected site.

Affected Systems

The affected vendor is WWBN, with the product name AVideo. No specific version information is listed in the CVE, so any deployment of AVideo that includes the confirmLivePassword.php script before the fix is potentially vulnerable.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate impact level. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating that no publicly disclosed exploits are known at this time. Attackers can exploit this by crafting a malicious URL that points to confirmLivePassword.php, which the victim clicks or visits, causing the injected script to run within the site origin. The risk is confined to the user’s browser session and does not directly compromise the server.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

WWBN

AVideo

unaffected

Version	Status	Constraints
`0`	affected	≤ c3edcc274c389816d434acadac07ee78eaf330c1

No data.

Vendor Product Versions

Wwbn

Avideo

Version	Status	Scheme	Platform
`[0,c3edcc274c389816d434acadac07ee78eaf330c1]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest AVideo release that addresses the reflected XSS in confirmLivePassword.php.
If an update is not immediately available, sanitize or URL‑encode the REQUEST_URI before inserting it into form action attributes to prevent quote injection.
Implement additional client‑side XSS defenses such as Content Security Policy or output encoding to mitigate the impact of any residual injection.

Generated by OpenCVE AI on September 11, 2026 at 14:36 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.263% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/WWBN/AVideo/security/advisories/GHSA-fp9p-hrc9-8rr7
https://www.vulncheck.com/advisories/wwbn-avideo-reflected-xss-via-confirmlivepassword-php-2

History

Sep 11, 2026 11:45 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 11, 2026 11:30 AM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in confirmLivePassword.php that copies REQUEST_URI into a form action attribute without encoding. Attackers can craft a malicious URL with a quote character to break out of the action attribute and inject event handlers that execute in the victim's browser within the site origin.
Title		WWBN AVideo Reflected XSS via confirmLivePassword.php
First Time appeared		Wwbn Wwbn avideo
Weaknesses		CWE-79
CPEs		cpe:2.3:a:wwbn:avideo:-:::::::*
Vendors & Products		Wwbn Wwbn avideo
References		https://github.com/WWBN/AVideo/security/advisories/GHSA-fp9p-hrc9-8rr7 https://www.vulncheck.com/advisories/wwbn-avideo-reflected-xss-via-confirmlivepassword-php-2
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N'}`