Security Advisory

CVE-2026-89241

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-09-11 11:15:22

Last updated 2026-09-11 19:19:40

Assigner VulnCheck

CVSS score 6.1

State PUBLISHED

Description

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in confirmLivePassword.php that copies REQUEST_URI into a form action attribute without encoding. Attackers can craft a malicious URL with a quote character to break out of the action attribute and inject event handlers that execute in the victim's browser within the site origin.

← Browse all CVEs View on cve.org ↗