https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 22 Oct 2026 16:46:23 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-277036 EUVD-2026-277036 https://cve.radiocsirt.org/vuln/euvd-2026-277036 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33295 <p>WWBN AVideo is an open source video platform. Prior to version 26.0, WWBN/AVideo contains a stored cross-site scripting vulnerability in the CDN plugin&#39;s download buttons component. The `clean_title` field of a video record is interpolated directly into a JavaScript string literal without any escaping, allowing an attacker who can create or modify a video to inject arbitrary JavaScript that executes in the browser of any user who visits the affected download page. Version 26.0 fixes the issue.</p> <p>WWBN AVideo is an open source video platform. Prior to version 26.0, WWBN/AVideo contains a stored cross-site scripting vulnerability in the CDN plugin&#39;s download buttons component. The `clean_title` field of a video record is interpolated directly into a JavaScript string literal without any escaping, allowing an attacker who can create or modify a video to inject arbitrary JavaScript that executes in the browser of any user who visits the affected download page. Version 26.0 fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-33295 https://cve.radiocsirt.org/vuln/ghsa-gc3m-4mcr-h3pv <p><strong>Affected:</strong> Packagist: wwbn/avideo</p> <p>### Summary</p> <p>WWBN/AVideo contains a stored cross-site scripting vulnerability in the CDN plugin&#39;s download buttons component. The `clean_title` field of a video record is interpolated directly into a JavaScript string literal without any escaping, allowing an attacker who can create or modify a video to inject arbitrary JavaScript that executes in the browser of any user who visits the affected download page.</p> <p>### Details</p> <p>At line 59 of the affected file, the following PHP code constructs a JavaScript function call:</p> <p>```php downloadURLOrAlertError(url, {}, &#39;&lt;?php echo $video[&#39;clean_title&#39;]; ?&gt;.&#39; + format, progress); ```</p> <p>The `clean_title` value is echoed verbatim inside a single-quoted JavaScript string literal. No JavaScript-context escaping is applied, such as wrapping with `json_encode` or htmlspecialchars with appropriate flags. Because the value sits inside a JS string delimited by single quotes, any input containing a single quote character allows an attacker to terminate the string prematurely and inject arbitrary JavaScript expressions. The `clean_title` field is derived from user-supplied video title input, meaning any user with video creation or editing privileges can craft a malicious title. The injected script executes in the security context of whatever user loads the download page for that video, which may include administrators or authenticated users with elevated privileges.</p> <p>### PoC</p> <p>```python import requests</p> <p>target = &#34;https://example.com&#34; login_url = f&#34;{ta…</p> <p><strong>Affected:</strong> Packagist: wwbn/avideo</p> <p>### Summary</p> <p>WWBN/AVideo contains a stored cross-site scripting vulnerability in the CDN plugin&#39;s download buttons component. The `clean_title` field of a video record is interpolated directly into a JavaScript string literal without any escaping, allowing an attacker who can create or modify a video to inject arbitrary JavaScript that executes in the browser of any user who visits the affected download page.</p> <p>### Details</p> <p>At line 59 of the affected file, the following PHP code constructs a JavaScript function call:</p> <p>```php downloadURLOrAlertError(url, {}, &#39;&lt;?php echo $video[&#39;clean_title&#39;]; ?&gt;.&#39; + format, progress); ```</p> <p>The `clean_title` value is echoed verbatim inside a single-quoted JavaScript string literal. No JavaScript-context escaping is applied, such as wrapping with `json_encode` or htmlspecialchars with appropriate flags. Because the value sits inside a JS string delimited by single quotes, any input containing a single quote character allows an attacker to terminate the string prematurely and inject arbitrary JavaScript expressions. The `clean_title` field is derived from user-supplied video title input, meaning any user with video creation or editing privileges can craft a malicious title. The injected script executes in the security context of whatever user loads the download page for that video, which may include administrators or authenticated users with elevated privileges.</p> <p>### PoC</p> <p>```python import requests</p> <p>target = &#34;https://example.com&#34; login_url = f&#34;{ta…</p> https://cve.radiocsirt.org/vuln/ghsa-gc3m-4mcr-h3pv