Is CVE-2026-61575 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61575 being exploited in the wild.

How severe is CVE-2026-61575?

Medium severity, with a CVSS score of 4.7, published 28 October 2026.

Which products and versions are affected?

WWBN AVideo Encoder before 8.1.0.

How is CVE-2026-61575 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-61575?

Check whether you run WWBN AVideo Encoder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61575: AVideo stored cross-site scripting in encoder queue title

CVE-2026-61575 · Severity: medium · CVSS 4.7 · Published 2026-10-28

AVideo is a video-sharing platform that uses an encoder queue to process video uploads. An attacker can inject malicious HTML into the queue entry title, which executes in the browsers of administrators or operators viewing the encoder interface. This allows the attacker to steal session data, capture credentials, and perform actions with the victim's privileges.

Technologies: WWBN AVideo Encoder. Vendors: WWBN.

Quick answers

Is CVE-2026-61575 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61575 being exploited in the wild.
How severe is CVE-2026-61575?: Medium severity, with a CVSS score of 4.7, published 28 October 2026.
Which products and versions are affected?: WWBN AVideo Encoder before 8.1.0.
Is there a fix for CVE-2026-61575?: Yes: fixed in 8.1.0. Until then: Restrict encoder queue access to trusted users and administrators only; disable encoder queue viewing for non-administrative users until patched. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61575 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-61575?: Check whether you run WWBN AVideo Encoder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 8.1.0

Restrict encoder queue access to trusted users and administrators only; disable encoder queue viewing for non-administrative users until patched.

Technical details

The vulnerability is a stored XSS in `view/queue.php` where user-controlled `fileURI` input is passed through `pathinfo()` and stored as `encoder_queue.title` without HTML sanitization. The title is later rendered into the jQuery Bootgrid table via `.html()` sink in `view/index.php`, allowing event handler execution. An attacker can self-grant upload capability via their own login site, then create a queue entry with JavaScript payload that executes for any administrator or operator viewing the encoder interface until the row is deleted.

Affected products

WWBN AVideo Encoder before 8.1.0

Timeline

2026-10-28: disclosed
2026-09-23: patched: Version 8.1.0 released with HTML escaping function applied to user-generated content

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.