{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/avideo-14.3---29.7.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.7,"id":"CVE-2026-126806"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["AVideo (14.3 - 29.7.1)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["WWBN"],"content_html":"\u003cp\u003eWWBN AVideo versions 14.3 through 29.7.1 are susceptible to a stored cross-site scripting (XSS) vulnerability. The application fails to properly sanitize the 'videoDownloadedLink' parameter when processing data through 'objects/aVideoEncoder.json.php'.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker (with uploader privileges) inputs a malicious script, typically an event-handler payload embedded within a URL host, into the 'videoDownloadedLink' parameter.\u003c/li\u003e\n\u003cli\u003eThe application stores the unescaped malicious payload via 'objects/aVideoEncoder.json.php'.\u003c/li\u003e\n\u003cli\u003eAn administrator navigates to the 'view/managerVideos_body.php' page, which renders the stored malicious payload within a Source tag.\u003c/li\u003e\n\u003cli\u003eThe script executes within the context of the administrator's active session.\u003c/li\u003e\n\u003cli\u003eThe attacker leverages the administrative session to upload or install malicious plugin archives containing PHP backdoors.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an attacker to execute arbitrary scripts in an administrator's browser session. This can be used to perform administrative actions, such as installing arbitrary plugin archives, leading to potential full remote code execution on the underlying server.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eInventory all deployments of WWBN AVideo. Since no patch is identified in the source, restrict administrative access and uploader privileges until an update is provided by the vendor. Hunt for anomalous plugin installations or suspicious entries in the 'videoDownloadedLink' field within the AVideo database.\u003c/p\u003e\n","date_modified":"2026-11-11T22:09:05Z","date_published":"2026-11-11T22:09:05Z","id":"https://feed.craftedsignal.io/briefs/2026-11-avideo-xss-cve-2026-126806/","summary":"WWBN AVideo versions 14.3 through 29.7.1 contain a stored cross-site scripting vulnerability in objects/aVideoEncoder.json.php that allows authenticated uploaders to execute malicious scripts in administrator sessions to install arbitrary PHP code.","title":"WWBN AVideo: Stored cross-site scripting vulnerability (CVE-2026-126806)","url":"https://feed.craftedsignal.io/briefs/2026-11-avideo-xss-cve-2026-126806/"}],"language":"en","title":"CraftedSignal Threat Feed - AVideo (14.3 - 29.7.1)","version":"https://jsonfeed.org/version/1.1"}