CVE-2026-89241: WWBN AVideo Reflected XSS via confirmLivePassword.php
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in confirmLivePassword.php that copies REQUESTURI into a form action attribute without encoding. Attackers can craft a malicious URL with a quote character to break out of the action attribute and inject event handlers that execute in the victim's browser within the site origin.
Affected Software
Event History
Frequently Asked Questions
Does exploitation require an attacker to authenticate or have elevated privileges?
No. The vector is network-accessible and requires no privileges, but a victim must interact with a crafted malicious URL.
What can an attacker do if the exploit succeeds?
Injected event handlers can execute in the victim's browser under the affected site's origin. The recorded impact includes low confidentiality and integrity impact, with no availability impact.
How can I determine whether my deployment is affected?
Inspect confirmLivePassword.php for code that places REQUEST_URI into a form action attribute without encoding. The issue is reported in WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1.