CVE-2026-84477: AVideo Stored XSS via Live Schedule Title Description
AVideo Liveschedule::setTitle() and setDescription() store POST input without sanitization, allowing users with streaming permission to inject malicious scripts. Unauthenticated attackers can access remindMe.php to execute stored XSS payloads in victim browsers without requiring authentication.
Affected Software
Event History
Frequently Asked Questions
Who can inject the malicious content?
A user with streaming permission can submit malicious script through the live schedule title or description fields. Exploitation requires that user to be authenticated and able to create or modify the relevant live-schedule content.
Who can be affected when the payload is viewed?
Unauthenticated users can reach remindMe.php, where the stored payload may execute in their browser. Victims do not need to authenticate for the XSS payload to be triggered.
Does exploitation require victim interaction?
Yes. The supplied vector indicates user interaction is required, meaning a victim must access the affected content or endpoint for the stored script to execute.