CVE-2026-84477: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in WWBN AVideo

This vulnerability in WWBN AVideo involves improper neutralization of input during web page generation, specifically in the Live_schedule::setTitle() and setDescription() methods that accept POST input without sanitization. This flaw allows users with streaming permissions to inject malicious scripts. Furthermore, unauthenticated attackers can access the remindMe.php endpoint to execute stored XSS payloads in the browsers of victims without requiring authentication. The CVSS 4.0 base score is 5.1, indicating medium severity. No patch or official remediation guidance is currently available, and no known exploits are reported in the wild.

Successful exploitation can lead to execution of arbitrary scripts in the context of victim browsers, potentially enabling theft of session tokens, defacement, or other malicious actions within the affected web application. Since unauthenticated attackers can trigger the stored XSS via remindMe.php, the attack surface includes users who visit that endpoint, increasing risk. However, the requirement for streaming permission to inject scripts limits initial injection to authorized users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict streaming permissions to trusted users only and consider implementing web application firewall (WAF) rules to detect and block malicious script payloads targeting the affected endpoints. Monitor vendor channels for updates and apply patches promptly once released.