CVE-2026-39367

WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's EPG (Electronic Program Guide) feature parses XML from user-controlled URLs and renders programme titles directly into HTML without any sanitization or escaping. A user with upload permission can set a video's epg_link to a malicious XML file whose <title> elements contain JavaScript. This payload executes in the browser of any unauthenticated visitor to the public EPG page, enabling session hijacking and account takeover.

CVSS v3.1

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVSS v3.1

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.19% chance of exploitation in the next 30 days, 9th percentile

Published

2026-04-07

Updated

2026-04-08

Proof-of-concept exploits (1)

• advisories/GHSA-rqp3-gf5h-mrqx

References

• CVE Record
• NVD entry

Related

• CVE-2026-39365
• CVE-2026-39368
• CVE-2026-39364
• CVE-2026-39369
• CVE-2026-39363
• CVE-2026-39370