CVE-2026-45580

WWBN AVideo is an open source video platform. In 29.0 and earlier, there is a stored cross-site scripting vulnerability. The Live plugin's "YouTube-style" view renders the live transmission's stream key into an HTML class attribute by raw echo, without htmlspecialchars(). A canStream user can persist a key containing " plus an event handler via plugin/Live/saveLive.php, and any visitor (logged in or anonymous) opening the stream's live page executes attacker JavaScript in the platform origin.

• CWE-79

• https://github.com/WWBN/AVideo/security/advisories/GHSA-m5j4-7r85-2cj2Mitigation, Vendor Advisory

Published

May 29, 2026

Last Modified

Jul 21, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-45574epa4all-client is the Java Client for epa4all / ePA 3.0 in t…8.1
• CVE-2026-45575epa4all-client is the Java Client for epa4all / ePA 3.0 in t…7.4
• CVE-2026-45576zrok is software for sharing web services, files, and networ…7.5
• CVE-2026-45577Neotoma provides versioned records that persist across agent…6.9
• CVE-2026-45578WWBN AVideo is an open source video platform. In 29.0 and ea…8.8
• CVE-2026-4558A flaw has been found in Linksys MR9600 2.0.6.206937. Affect…8.8
• CVE-2026-45581fabric-chaincode-java is a Java based implementation of Hype…5.5
• CVE-2026-45582n8n-MCP is an MCP server that provides AI assistants access …6.5
• CVE-2026-45583Improper control of generation of code ('code injection') in…8.1
• CVE-2026-45584Heap-based buffer overflow in Microsoft Defender allows an u…8.1
• CVE-2026-45585Microsoft is aware of a security feature bypass vulnerabilit…6.8
• CVE-2026-45586Improper link resolution before file access ('link following…7.8