CVE-2026-85577: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in WWBN AVideo

CVE-2026-85577 describes a reflected cross-site scripting vulnerability in WWBN AVideo's userLogin.php. An attacker can inject arbitrary JavaScript by closing the script tag with </script> in the error parameter of the login page URL. This allows execution of attacker-controlled scripts in the victim's browser context without requiring authentication. The vulnerability was identified through commit c91b5975d. No official remediation or patch information is provided in the available data.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser on the login page, potentially leading to session hijacking, credential theft, or other client-side attacks. However, the vulnerability requires user interaction (clicking a crafted URL) and has a medium severity score (CVSS 5.3). There is no indication of known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when clicking on suspicious URLs targeting the login page. Vendors and users should monitor for updates from WWBN regarding patches or mitigations for this vulnerability.