CVE-2026-92584

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 29.1

Description A stored cross-site scripting issue exists where the unauthenticated endpoint 'objects/videoAddViewCount.json.php' calls the VideoStatistic::save() function. This process writes the caller's User-Agent string, retrieved via getUserAgentInfo(), directly into the app column of the videos statistics table without proper sanitization through setApp(), as normalizeApp() only truncates the value. When a video owner or administrator accesses the statistics page 'view/videoViewsInfo.php', the field is rendered using an unescaped renderer in DataTables 1.12.1. Because DataTables uses innerHTML to assign cell content, attacker-supplied HTML is executed within the authenticated session of the privileged user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.