CVE-2026-45580
CVE-2026-45580 · WWBN AVideo Live: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
WWBN AVideo is an open source video platform. In 29.0 and earlier, there is a stored cross-site scripting vulnerability. The Live plugin's "YouTube-style" view renders the live transmission's stream key into an HTML class attribute by raw echo, without htmlspecialchars(). A canStream user can persist a key containing " plus an event handler via plugin/Live/saveLive.php, and any visitor (logged in or anonymous) opening the stream's live page executes attacker JavaScript in the platform origin.
CVSS 5.4 · Media · EPSS 0,1%
- Publicación
- Actualización
Pila tecnológica: php
Productos y versiones afectados
avideo
- Versiones
- <= 29.0: Afectada
Sin corrección publicada
wwbn/avideo Packagist
- Intervalos de versiones afectados
- ECOSYSTEM: ≤ 29.0
Sin corrección publicada