CVE-2026-84477CWE-79cross-site-scripting

CVE-2026-84477

Medium · published September 2, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
20.6
In the wild
Unconfirmed
What it is

AVideo Live_schedule::setTitle() and setDescription() store POST input without sanitization, allowing users with streaming permission to inject malicious scripts. Unauthenticated attackers can access remindMe.php to execute stored XSS payloads in victim browsers without requiring authentication.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
5.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
EPSS
0.00292 · 20.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-09-02T03:17Z
References (3)
https://github.com/WWBN/AVideo/security/advisories/GHSA-625v-vrhq-g274 · [email protected]https://www.vulncheck.com/advisories/avideo-stored-xss-via-live-schedule-title-description · [email protected]https://github.com/WWBN/AVideo/security/advisories/GHSA-625v-vrhq-g274 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 03 SEP 03:32Z
    EPSS moved — → 0%
    epss
  • 01 SEP 22:25Z
    AVideo Stored XSS via Live Schedule Title Description
    cvelistv5