PoC Index85,092 CVEs with PoCs

CVE-2026-39367

WWBN AVideo has Stored XSS via Malicious EPG XML Program Titles in AVideo EPG Page

MEDIUM 5.4EPSS 0.2%

WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's EPG (Electronic Program Guide) feature parses XML from user-controlled URLs and renders programme titles directly into HTML without any sanitization or escaping. A user with upload permission can set a video's epg_link to a malicious XML file whose <title> elements contain JavaScript. This payload executes in the browser of any unauthenticated visitor to the public EPG page, enabling session hijacking and account takeover.

Affected
WWBN · AVideo
CVSS v3.1 GITHUB
5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS
0.24% chance of exploitation in the next 30 days, 14th percentile
Published
2026-04-07
Updated
2026-04-08

Proof-of-concept exploits (1)

Security advisories

References