Medium severity5.4NVD Advisory· Published Sep 1, 2026· Updated Sep 8, 2026
CVE-2026-84477
CVE-2026-84477
Description
AVideo Live_schedule::setTitle() and setDescription() store POST input without sanitization, allowing users with streaming permission to inject malicious scripts. Unauthenticated attackers can access remindMe.php to execute stored XSS payloads in victim browsers without requiring authentication.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
2News mentions
2- WWBN AVideo: 25 Vulnerabilities Disclosed in Early September 2026 BatchVypr Intelligence · Sep 5, 2026
- WWBN AVideo: 16 Vulnerabilities Disclosed, Including Critical Auth and Password Reset FlawsVypr Intelligence · Sep 1, 2026