CVE-2026-89241 — WWBN AVideo Reflected XSS via confirmLivePassword.php
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in confirmLivePassword.php that copies REQUEST_URI in…
Published: 2026-09-11 · CVSS: 5.3 · CVSS 4.0
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in confirmLivePassword.php that copies REQUEST_URI into a form action attribute without encoding. Attackers can craft a malicious URL with a quote character to break out of the action attribute and inject event handlers that execute in the victim's browser within the site origin.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7