CVE-2026-34739

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the User_Location plugin's testIP.php page reflects the ip request parameter directly into an HTML input element without applying htmlspecialchars() or any other output encoding. This allows an attacker to inject arbitrary HTML and JavaScript via a crafted URL. Although the page is restricted to admin users, AVideo's SameSite=None cookie configuration allows cross-origin exploitation, meaning an attacker can lure an admin to a malicious link that executes JavaScript in their authenticated session. At time of publication, there are no publicly available patches.

• CWE-79

• https://github.com/WWBN/AVideo/security/advisories/GHSA-jqrj-chh6-8h78Exploit, Vendor Advisory
• https://github.com/WWBN/AVideo/security/advisories/GHSA-jqrj-chh6-8h78Exploit, Vendor Advisory

Published

Mar 31, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34733WWBN AVideo is an open source video platform. In versions 26…7.3
• CVE-2026-34734HDF5 is software for managing data. In 1.14.1-2 and earlier,…7.8
• CVE-2026-34735The Hytale Modding Wiki is a free service for Hytale mods to…8.7
• CVE-2026-34736Open edX Platform enables the authoring and delivery of onli…5.3
• CVE-2026-34737WWBN AVideo is an open source video platform. In versions 26…6.5
• CVE-2026-34738WWBN AVideo is an open source video platform. In versions 26…4.3
• CVE-2026-3474The EmailKit – Email Customizer for WooCommerce & WP plugin …4.9
• CVE-2026-34740WWBN AVideo is an open source video platform. In versions 26…6.5
• CVE-2026-34742The Go MCP SDK used Go's standard encoding/json. Prior to ve…8.1
• CVE-2026-34743XZ Utils provide a general-purpose data-compression library …5.3
• CVE-2026-34744Mantis Bug Tracker (MantisBT) is an open source issue tracke…5.3
• CVE-2026-34745Fireshare facilitates self-hosted media and link sharing. Pr…9.1