WWBN AVideo: Stored cross-site scripting via trailer1 URL in YouPHPFlix2 templates
Summary
AVideo through 29.2.0 does not escape the trailer1 video URL in several YouPHPFlix2 templates and channel playlists. A user with upload permission can store a crafted trailer URL that breaks out of JavaScript strings or iframe attributes. The script then runs in the browser of any visitor who views the affected page, including administrators, under the site's origin.
Affected
- WWBN AVideo through 29.2.0 (VulnCheck range: 0 to 29.2.0)
Fixed in
Unknown. The vendor advisory GHSA-6wfr-c7fw-4xvw lists no patched version; the referenced fix commit c4adfde is not yet mapped to a release.
Workaround
Unknown. No vendor workaround was found.
Exploitation
- Not listed in CISA KEV; no known active exploitation reported.
- CISA SSVC exploitation value: poc (a proof of concept may exist; not verified).
- Attacker needs an account with upload permission; CISA rates automatable as no.
Our recommendation
- Restrict upload and video-edit permissions to trusted staff only.
- Review existing trailer1 values for script-like content.
- Limit access to the admin panel and check accounts with upload rights.
- Check whether AVideo is internet-exposed and plan an upgrade as soon as the fixed version is confirmed in the GHSA advisory.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-105089 record (VulnCheck advisory) www.vulncheck.com
- GitHub Security Advisory GHSA-6wfr-c7fw-4xvw github.com
- Fix commit c4adfde github.com
- CVE JSON record (CISA ADP) raw.githubusercontent.com
- OSV record osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:28.
Original description (NVD)
WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 URL. The value is rendered unescaped in YouPHPFlix2 templates and channel playlists, letting attackers break out of onclick strings or iframe src attributes to execute JavaScript in victims' browsers.
NVD references (4)
- https://github.com/WWBN/AVideo/commit/c4adfde13d1f18e3a415722471efdcd8ab480035
- https://github.com/WWBN/AVideo/security/advisories/GHSA-6wfr-c7fw-4xvw
- https://www.vulncheck.com/advisories/wwbn-avideo-through-29.2.0-stored-xss-via-trailer1-in-youphpflix2-templa…
- https://github.com/WWBN/AVideo/security/advisories/GHSA-6wfr-c7fw-4xvw
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.