CVE-2026-39367

WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's EPG (Electronic Program Guide) feature parses XML from user-controlled URLs and renders programme titles directly into HTML without any sanitization or escaping. A user with upload permission can set a video's epg_link to a malicious XML file whose <title> elements contain JavaScript. This payload executes in the browser of any unauthenticated visitor to the public EPG page, enabling session hijacking and account takeover.

• CWE-79

• https://github.com/WWBN/AVideo/commit/e0212add4aad0f1e97758a4b4fdc57df58ce68e8Patch
• https://github.com/WWBN/AVideo/security/advisories/GHSA-rqp3-gf5h-mrqxThird Party Advisory
• https://github.com/WWBN/AVideo/security/advisories/GHSA-rqp3-gf5h-mrqxThird Party Advisory

Published

Apr 7, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-39361OpenObserve is a cloud-native observability platform. In 0.7…7.7
• CVE-2026-39362InvenTree is an Open Source Inventory Management System. Pri…7.1
• CVE-2026-39363Vite is a frontend tooling framework for JavaScript. From 6.…7.5
• CVE-2026-39364Vite is a frontend tooling framework for JavaScript. From 7.…7.5
• CVE-2026-39365Vite is a frontend tooling framework for JavaScript. From 6.…5.3
• CVE-2026-39366WWBN AVideo is an open source video platform. In versions 26…6.5
• CVE-2026-39368WWBN AVideo is an open source video platform. In versions 26…6.5
• CVE-2026-39369WWBN AVideo is an open source video platform. In versions 26…7.6
• CVE-2026-3937Incorrect security UI in Downloads in Google Chrome on Andro…6.5
• CVE-2026-39370WWBN AVideo is an open source video platform. In versions 26…7.1
• CVE-2026-39371RedwoodSDK is a server-first React framework. From 1.0.0-bet…8.1
• CVE-2026-39373JWCrypto implements JWK, JWS, and JWE specifications using p…5.3