CVE-2026-45580

WWBN AVideo is an open source video platform. In 29.0 and earlier, there is a stored cross-site scripting vulnerability. The Live plugin's "YouTube-style" view renders the live transmission's stream key into an HTML class attribute by raw echo, without htmlspecialchars(). A canStream user can persist a key containing " plus an event handler via plugin/Live/saveLive.php, and any visitor (logged in or anonymous) opening the stream's live page executes attacker JavaScript in the platform origin.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/WWBN/AVideo/security/advisories/GHSA-m5j4-7r85-2cj2	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*

History

21 Jul 2026, 12:10

Type	Values Removed	Values Added
Summary		(es) WWBN AVideo es una plataforma de video de código abierto. En 29.0 y anteriores, existe una vulnerabilidad de cross-site scripting almacenado. La vista 'estilo YouTube' del plugin Live renderiza la clave de transmisión de la transmisión en vivo en un atributo de clase HTML mediante un echo sin procesar, sin htmlspecialchars(). Un usuario canStream puede persistir una clave que contenga ' más un gestor de eventos a través de plugin/Live/saveLive.php, y cualquier visitante (autenticado o anónimo) que abra la página en vivo del stream ejecuta JavaScript del atacante en el origen de la plataforma.

01 Jun 2026, 18:41

Type	Values Removed	Values Added
References	~~() https://github.com/WWBN/AVideo/security/advisories/GHSA-m5j4-7r85-2cj2 -~~	() https://github.com/WWBN/AVideo/security/advisories/GHSA-m5j4-7r85-2cj2 - Mitigation, Vendor Advisory
CPE		cpe:2.3:a:wwbn:avideo::::::::
First Time		Wwbn Wwbn avideo

29 May 2026, 14:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-05-29 14:16

Updated : 2026-07-21 12:10

NVD link : CVE-2026-45580

Mitre link : CVE-2026-45580

CVE.ORG link : CVE-2026-45580

JSON object : View

Products Affected

wwbn

avideo

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-45580", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45580", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-02T01:09:36.754990Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "WWBN", "product": "AVideo", "versions": [{"status": "affected", "version": "<= 29.0"}]}]}], "published": "2026-05-29T14:16:30.413", "references": [{"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-m5j4-7r85-2cj2", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In 29.0 and earlier, there is a stored cross-site scripting vulnerability. The Live plugin's \"YouTube-style\" view renders the live transmission's stream key into an HTML class attribute by raw echo, without htmlspecialchars(). A canStream user can persist a key containing \" plus an event handler via plugin/Live/saveLive.php, and any visitor (logged in or anonymous) opening the stream's live page executes attacker JavaScript in the platform origin."}, {"lang": "es", "value": "WWBN AVideo es una plataforma de video de c\u00f3digo abierto. En 29.0 y anteriores, existe una vulnerabilidad de cross-site scripting almacenado. La vista 'estilo YouTube' del plugin Live renderiza la clave de transmisi\u00f3n de la transmisi\u00f3n en vivo en un atributo de clase HTML mediante un echo sin procesar, sin htmlspecialchars(). Un usuario canStream puede persistir una clave que contenga ' m\u00e1s un gestor de eventos a trav\u00e9s de plugin/Live/saveLive.php, y cualquier visitante (autenticado o an\u00f3nimo) que abra la p\u00e1gina en vivo del stream ejecuta JavaScript del atacante en el origen de la plataforma."}], "lastModified": "2026-07-21T12:10:00.090", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AC38CA07-71C1-4C86-B84A-83CF96367CBA", "versionEndIncluding": "29.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}