VYPR
← All advisories
High severity8.1NVD Advisory· Published Sep 11, 2026· Updated Sep 11, 2026

CVE-2026-89243

CVE-2026-89243

Description

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in UserGroups::setGroup_name() that fails to sanitize group_name input. Administrators with canAdminUserGroups permission can inject malicious HTML and JavaScript that executes in the browser when other administrators access the user manager interface.

Affected products

2
  • WWBN/Avideoinferred2 versions
    <=c3edcc274c389816d434acadac07ee78eaf330c1+ 1 more
    • (no CPE)range: <=c3edcc274c389816d434acadac07ee78eaf330c1
    • (no CPE)

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.