CVE Explorer
CVE-2026-34739
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the User_Location plugin's testIP.php page reflects the ip request parameter directly into an HTML input element without applying htmlspecialchars() or any other output encoding. This allows an attacker to inject arbitrary HTML and JavaScript via a crafted URL. Although the page is restricted to admin users, AVideo's SameSite=None cookie configuration allows cross-origin exploitation, meaning an attacker can lure an admin
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"product":"AVideo","vendor":"WWBN","versions":[{"status":"affected","version":"<= 26.0"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:48e92d0fcf0b52e377e4d83f7b5926440a68495f893b6238908373a9eff8ec8b · sha256:f25c10493e624c32… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:48e92d0fcf0b52e377e4d83f7b5926440a68495f893b6238908373a9eff8ec8b · sha256:f25c10493e624c32… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-79","description":"CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:48e92d0fcf0b52e377e4d83f7b5926440a68495f893b6238908373a9eff8ec8b · sha256:f25c10493e624c32… · /containers/cna/problemTypes/0/descriptions/0
Source references
2 source assertions{"name":"https://github.com/WWBN/AVideo/security/advisories/GHSA-jqrj-chh6-8h78","tags":["x_refsource_CONFIRM"],"url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-jqrj-chh6-8h78"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:48e92d0fcf0b52e377e4d83f7b5926440a68495f893b6238908373a9eff8ec8b · sha256:f25c10493e624c32… · /containers/cna/references/0
{"tags":["exploit"],"url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-jqrj-chh6-8h78"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:48e92d0fcf0b52e377e4d83f7b5926440a68495f893b6238908373a9eff8ec8b · sha256:f25c10493e624c32… · /containers/adp/0/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.