CVE-2026-84477

5.1 mediumEPSS 0.3%

Medium (5.1). EPSS 0.3% chance of exploitation in the next 30 days.

AVideo Live_schedule::setTitle() and setDescription() store POST input without sanitization, allowing users with streaming permission to inject malicious scripts. Unauthenticated attackers can access remindMe.php to execute stored XSS payloads in victim browsers without requiring authentication.

Severity

CVSS 4.0

5.1 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 21% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2026-09-01
Modified: 2026-09-08
Record from: the NVD, synced 2026-10-19

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-625v-vrhq-g274
https://www.vulncheck.com/advisories/avideo-stored-xss-via-live-schedule-title-description
https://github.com/WWBN/AVideo/security/advisories/GHSA-625v-vrhq-g274

Check your stack JSON