WWBN AVideo EUVD-2026-92113

Requires an authenticated account with video-upload privileges (PR:L) on an AVideo instance running versions 12.4 through 29.2.0; the attacker injects the payload specifically through the video title field using doubly-encoded HTML entities that survive safeString()'s strip-then-decode ordering across the setTitle() and save() passes. Exploitation further requires a victim to actually view one of the rendering surfaces (trending, gallery, embed, or playlist pages), per UI:P - the script does not fire until a page is loaded. Impact is maximized when the viewing victim is a privileged user (e.g. an administrator). Limiting factors: no anonymous/unauthenticated path, mandatory victim page-load, and the condition is removed once the patched build (strip_tags in safeString plus htmlspecialchars output encoding in the templates) is deployed.

This is a genuinely notable but context-limited vulnerability rather than a mass-exploitation emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/SC:H/SI:H) scores 9.3 and reflects the worst case of a stored XSS that fires across trending, gallery, embed, and playlist pages - meaning an attacker-controlled script can run in the sessions of many viewers, including administrators, enabling session hijacking or account/content takeover. However, two signals temper the raw score: PR:L means the attacker must be an authenticated uploader (not an anonymous internet user), and UI:P means a victim must load an affected page for the payload to execute. No EPSS score, KEV listing, or explicit POC flag was provided in the input, so there is no quantitative exploitation-probability signal and no confirmation of in-the-wild use. Note a mild tension worth verifying: the vendor rates confidentiality/integrity impact as HIGH (VC:H/VI:H), which is defensible for XSS that can reach admin sessions, but typical stored-XSS base scoring treats these as LOW-to-moderate - the HIGH rating assumes high-value victims view the payload. Bottom line: prioritize patching on any multi-user or publicly accessible AVideo instance where untrusted users can upload, but treat the 9.3 as a near-worst-case ceiling conditioned on privileged victims and user interaction, not a drive-by remote-code-execution-equivalent.

An attacker registers or obtains an uploader-level account on an AVideo instance and submits a video whose title contains doubly-encoded HTML entities (e.g. nested &amp;amp;lt; sequences). Because safeString() strips tags before decoding entities and is applied twice (via setTitle() and again in save()), the stored title is decoded into a live <img onerror=...> or similar tag. When any other user - ideally an administrator - browses the trending, gallery, embed, or playlist pages, the injected JavaScript executes in their authenticated session. Detailed payloads appear in the vendor's regression test, but no packaged public exploit was indicated in the input.