CVE-2026-82646

Name of the Vulnerable Software and Affected Versions WWBN AVideo (affected versions not specified)

Description An unauthenticated reflected cross-site scripting issue exists in the 'url2Embed.json.php' endpoint. This occurs when the application fails to properly handle URLs containing HTML metacharacters, allowing attackers to inject malicious scripts. By creating an encrypted evideo payload with unescaped markup and delivering it as a link on the site's own domain, an attacker can execute JavaScript within a victim's session to steal cookies or CSRF tokens (Cross-Site Request Forgery tokens, which are unique identifiers used to prevent unauthorized commands from being transmitted from a user the web application trusts).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.