CVE-2026-39367: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in WWBN AVideo
WWBN AVideo versions 26. 0 and earlier contain a cross-site scripting (XSS) vulnerability in the Electronic Program Guide (EPG) feature. The vulnerability arises because the EPG parses XML from user-controlled URLs and directly renders <title> elements into HTML without sanitization or escaping. An authenticated user with upload permissions can exploit this by setting a video's epg_link to a malicious XML file containing JavaScript in the <title> elements. This malicious script executes in the browsers of unauthenticated visitors to the public EPG page, potentially allowing session hijacking and account takeover. The vulnerability has a CVSS score of 5. 4, indicating medium severity. No official patch or remediation guidance is currently available.
AI Analysis
Technical Summary
CVE-2026-39367 is a cross-site scripting vulnerability (CWE-79) in WWBN AVideo's EPG feature in versions 26.0 and prior. The EPG feature parses XML from user-supplied URLs and inserts the <title> elements directly into HTML without any sanitization or escaping. This allows an authenticated user with upload permissions to specify a malicious XML file with JavaScript payloads in the <title> tags. When an unauthenticated visitor accesses the public EPG page, the malicious script executes in their browser, enabling session hijacking and account takeover. The vulnerability is rated medium severity with a CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). There is no known exploit in the wild and no official patch or remediation level has been published.
Potential Impact
Successful exploitation allows an attacker with upload permissions to inject malicious JavaScript into the public EPG page viewed by unauthenticated visitors. This can lead to session hijacking and account takeover of those visitors. The impact affects confidentiality and integrity but not availability. The vulnerability requires low privileges (upload permission) and user interaction (visiting the EPG page).
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict upload permissions to trusted users only and consider disabling or restricting access to the EPG feature if possible to reduce exposure.
CVE-2026-39367: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in WWBN AVideo
Description
WWBN AVideo versions 26. 0 and earlier contain a cross-site scripting (XSS) vulnerability in the Electronic Program Guide (EPG) feature. The vulnerability arises because the EPG parses XML from user-controlled URLs and directly renders <title> elements into HTML without sanitization or escaping. An authenticated user with upload permissions can exploit this by setting a video's epg_link to a malicious XML file containing JavaScript in the <title> elements. This malicious script executes in the browsers of unauthenticated visitors to the public EPG page, potentially allowing session hijacking and account takeover. The vulnerability has a CVSS score of 5. 4, indicating medium severity. No official patch or remediation guidance is currently available.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-39367 is a cross-site scripting vulnerability (CWE-79) in WWBN AVideo's EPG feature in versions 26.0 and prior. The EPG feature parses XML from user-supplied URLs and inserts the <title> elements directly into HTML without any sanitization or escaping. This allows an authenticated user with upload permissions to specify a malicious XML file with JavaScript payloads in the <title> tags. When an unauthenticated visitor accesses the public EPG page, the malicious script executes in their browser, enabling session hijacking and account takeover. The vulnerability is rated medium severity with a CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). There is no known exploit in the wild and no official patch or remediation level has been published.
Potential Impact
Successful exploitation allows an attacker with upload permissions to inject malicious JavaScript into the public EPG page viewed by unauthenticated visitors. This can lead to session hijacking and account takeover of those visitors. The impact affects confidentiality and integrity but not availability. The vulnerability requires low privileges (upload permission) and user interaction (visiting the EPG page).
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict upload permissions to trusted users only and consider disabling or restricting access to the EPG feature if possible to reduce exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-06T21:29:17.350Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69d55f07aaed68159a56294e
Added to database: 4/7/2026, 7:46:15 PM
Last enriched: 4/15/2026, 12:39:36 PM
Last updated: 5/22/2026, 6:46:54 AM
Views: 38
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.