Skip to content
CVE PROGRAM SOURCE RECORD9.2 Critical

CVE-2026-89243

WWBN AVideo Stored XSS via UserGroups setGroup_name

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in UserGroups::setGroup_name() that fails to sanitize group_name input. Administrators with canAdminUserGroups permission can inject malicious HTML and JavaScript that executes in the browser when other administrators access the user manager interface.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WWBN AVideo

Default version status: unaffected

  • 0 to ≤ c3edcc274c389816d434acadac07ee78eaf330c1affected

References