CVE-2026-126806

Name of the Vulnerable Software and Affected Versions AVideo versions 14.3 through 29.7.1

Description A stored cross-site scripting issue exists where uploaders can inject scripts through the videoDownloadedLink value, which is stored unescaped via the 'objects/aVideoEncoder.json.php' endpoint. Attackers can embed event-handler payloads in the URL host that is rendered as a Source tag in 'view/managerVideos body.php'. This allows the execution of scripts within administrator sessions to install plugin archives containing PHP.

Recommendations Update AVideo to a version newer than 29.7.1. Restrict access to the 'objects/aVideoEncoder.json.php' endpoint to minimize the risk of exploitation.