CVE-2026-105089

Published 4 October 2026 · tracked since 4 October 2026

Description

WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 URL. The value is rendered unescaped in YouPHPFlix2 templates and channel playlists, letting attackers break out of onclick

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-105217 LOW 3.1
• CVE-2026-105219 HIGH 7.5
• CVE-2026-105224 MEDIUM 5.4
• CVE-2026-105215 CRITICAL 9.1
• CVE-2026-105158 HIGH 7.3
• CVE-2026-105156 LOW 3.7
• CVE-2026-105146 MEDIUM 4.7
• CVE-2026-105144 MEDIUM 5.3
• CVE-2026-105137 MEDIUM 5
• CVE-2026-86817

→ Open the live CVE board · all tools