CVE-2026-100630

Name of the Vulnerable Software and Affected Versions AVideo (affected versions not specified)

Description A stored cross-site scripting issue exists where the video trailer1 field is rendered without proper sanitization inside an inline onclick JavaScript string. Users with video upload permissions can provide HTML entity-encoded payloads that bypass the isValidURL() function validation. The browser subsequently decodes these payloads, allowing the attacker to break out of the JavaScript string and execute arbitrary code in the session of any visitor, including those with administrator privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.