by Kastro
Paper/Archive/CVE-2026-88869

CVE-2026-88869

WWBN AVideo — AVideo AD_Server Stored XSS via log.php label parameter

EPSS 0.5%public exploitCVSS 9.3
critical.is priorityof 100
47
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 44.7.447 × 208.9Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the AD_Server plugin's log.php endpoint that fails to escape the label parameter before storage. An unauthenticated attacker can inject malicious HTML through the label parameter, which is later rendered unsanitized in the admin Ad Types report using jQuery .html(), allowing execution of arbitrary JavaScript in an administrator's browser session.

Affected

ProductAffectedFixed inSource
AVideo≤ c3edcc274c389816d434acadac07ee78eaf330c1–CNA

Scores by source

VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
VulnCheck (CNA)9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitgithub.com/WWBN/AVideo/security/advisories/GHSA-h68w-3r38-wmm8writeupvulncheck.com/advisories/avideo-ad-server-stored-xss-via-log-php-label-parameter