CVE-2026-84477

Name of the Vulnerable Software and Affected Versions AVideo (affected versions not specified)

Description The setTitle() and setDescription() functions in Live schedule store POST input without proper sanitization. This allows users with streaming permissions to inject malicious scripts. Additionally, unauthenticated attackers can access the 'remindMe.php' endpoint to execute stored Cross-Site Scripting (XSS) payloads—a technique where malicious scripts are permanently stored on the target server—in the browsers of victims without requiring authentication.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.