CVE-2026-89243 - WWBN AVideo Stored XSS via UserGroups setGroup_name

Back Back to CVE browser

CRITICAL

WWBN AVideo Stored XSS via UserGroups setGroup_name

Published Sep 11, 2026

9.2

CRITICAL

CVSS 4.0

EPSS 0.38%

Description

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in UserGroups::setGroup_name() that fails to sanitize group_name input. Administrators with canAdminUserGroups permission can inject malicious HTML and JavaScript that executes in the browser when other administrators access the user manager interface.

Affected products

Vendor WWBN Product AVideo Default
unaffected
- Version
  0
  Status
  affected
  Constraints

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

WWBN

AVideo

unaffected

Version	Status	Constraints
0	affected

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-76055
Advisory
https://github.com/WWBN/AVideo/security/advisories/GHSA-qm3h-2jrx-xmg6
exploitvendor-advisory
https://www.vulncheck.com/advisories/wwbn-avideo-stored-xss-via-usergroups-setgroup-name
third-party-advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-76055		Advisory
https://github.com/WWBN/AVideo/security/advisories/GHSA-qm3h-2jrx-xmg6		exploitvendor-advisory
https://www.vulncheck.com/advisories/wwbn-avideo-stored-xss-via-usergroups-setgroup-name		third-party-advisory