Executive brief
WWBN AVideo is a video hosting and streaming platform used by organizations to manage video content and user groups. The system contains a stored cross-site scripting vulnerability in the user group management interface that allows administrators with group management permissions to inject malicious scripts that execute when other administrators access the system. An attacker with these privileges can steal sensitive data or perform unauthorized administrative actions on behalf of victim administrators.
Technical details
The vulnerability exists in UserGroups::setGroup_name() which fails to sanitize the group_name parameter before storing it in the database. The file view/managerUsers.php subsequently echoes the stored group_name value without HTML encoding (htmlspecialchars), allowing execution of injected JavaScript. An attacker with canAdminUserGroups permission can POST a malicious payload like <img src=x onerror=alert(1)> to objects/userGroupsAddNew.json.php; when any other administrator opens the user manager interface, the script executes in their authenticated session. This allows the attacker to perform administrative actions via same-origin fetch() requests. The vulnerability requires network access, valid administrator credentials with specific permissions, and user interaction (opening the manager interface). No patch is available as of the publication date.
Affected products
- WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
Timeline
- 2026-08-27: disclosed: GitHub Security Advisory published
- 2026-09-11: advisory: CVE-2026-89243 published