VYPR
← All advisories
Medium severity6.1NVD Advisory· Published Sep 11, 2026

CVE-2026-89239

CVE-2026-89239

Description

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in the showAlertMessage() function that inserts the raw Referer header into a JavaScript comment without encoding. Attackers can craft a Referer header containing */ to close the comment and inject arbitrary JavaScript that executes in the site origin for visitors arriving from the attacker-controlled page.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • WWBN/Avideoinferred2 versions
    <=c3edcc274c389816d434acadac07ee78eaf330c1+ 1 more
    • (no CPE)range: <=c3edcc274c389816d434acadac07ee78eaf330c1
    • (no CPE)range: <c3edcc274c389816d434acadac07ee78eaf330c1

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.