CVE-2026-86188— AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting
Quick assessment
Affected
WWBN AVideo
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
启用了 YPTSocket 插件的 AVideo 存在一个跨站脚本（XSS）漏洞，允许未认证的攻击者通过 websocket 回调机制，在其他用户的浏览器中执行任意 JavaScript 代码。攻击者可以构造特定的 socket 消息，使回调名称解析到诸如 这样的全局函数，这些函数会接受不受信任的数据并将其赋值给 ，从而在受害者的源（origin）中实现脚本执行，且无需身份验证或用户交互。
Possible ATT&CK Techniques 3 AI
T1029 · Scheduled Transfer T1567 · Exfiltration Over Web Service T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-86188
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting
Source: CVE Program / CVE List V5
Vulnerability Description
AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other users' browsers via the websocket callback mechanism. Attackers can send crafted socket messages with callback names resolving to global functions like avideoConfirmHTML that accept untrusted data and assign it to innerHTML, achieving script execution in the victim's origin without authentication or user interaction.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-86188
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-86188
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-86188 (2)
Same Patch Batch · WWBN · 2026-09-05 · 5 CVEs total
| CVE-2026-86189 | 9.8 CRITICAL | WWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg.json.php |
| CVE-2026-86190 | 9.1 CRITICAL | WWBN AVideo Broken Access Control via videoViewsInfo hash Parameter |
| CVE-2026-86186 | 6.5 MEDIUM | AVideo API Rate Limit Bypass via Bot User-Agent Header |
| CVE-2026-86187 | 5.9 MEDIUM | WWBN AVideo Weak PRNG Password Generation via External Login |
IV. Related Vulnerabilities
Same product: AVideo
-
CVE-2026-86189
WWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg -
CVE-2026-86190
WWBN AVideo Broken Access Control via videoViewsInfo hash Pa -
CVE-2026-86187
WWBN AVideo Weak PRNG Password Generation via External Login -
CVE-2026-86186
AVideo API Rate Limit Bypass via Bot User-Agent Header -
CVE-2026-85577
AVideo userLogin.php Reflected XSS via error parameter
Same vendor: WWBN
-
CVE-2026-86189
WWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg -
CVE-2026-86190
WWBN AVideo Broken Access Control via videoViewsInfo hash Pa -
CVE-2026-86186
AVideo API Rate Limit Bypass via Bot User-Agent Header -
CVE-2026-86187
WWBN AVideo Weak PRNG Password Generation via External Login -
CVE-2026-85577
AVideo userLogin.php Reflected XSS via error parameter
Same weakness: CWE-79
-
CVE-2026-86197
Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox -
CVE-2026-76573
Pods <= 3.3.9.1 - Authenticated (Contributor+) Stored Cross- -
CVE-2026-83625
Contact Form by Supsystic <= 1.10.2 - Unauthenticated Stored -
CVE-2026-85414
Gallery : FooGallery <= 3.3.2 - Authenticated (Contributor+) -
CVE-2026-75586
Unlimited Elements For Elementor <= 2.0.17 - Reflected Cross
V. Comments for CVE-2026-86188
No comments yet