Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-92584— AVideo through 29.0 Stored Cross-Site Scripting via User-Agent Header

Quick assessment

Affected
WWBN AVideo
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

AVideo 29.0 及更早版本（当前修订版 e01e41ecc）中存在一个存储型跨站脚本（XSS）漏洞。 未认证的视图计数器接口 会调用 方法，该方法通过 获取调用方的 User-Agent。当 User-Agent 无法被识别时，其原始字符串会被直接写入 表的 列，而未调用用于数据净化的 设置器； 仅将该字段值截断为最多 45 个字符，并未进行 HTML 转义。 视频所有者和管理员在查看统计页面（ ）时，该字段会通过 DataTables 1.12.1 的列渲染器以未转义的方式呈现，而 DataTables

CVSS 6.1 · Medium EPSS 0.26% · P18

Affected Version Matrix 1

VendorProduct Version RangeStatus
WWBN AVideo ≤ 29.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-92584

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
AVideo through 29.0 Stored Cross-Site Scripting via User-Agent Header
Source: CVE Program / CVE List V5
Vulnerability Description
AVideo through 29.0 (current revision e01e41ecc) contains a stored cross-site scripting vulnerability. The unauthenticated view-counter endpoint objects/videoAddViewCount.json.php reaches VideoStatistic::save(), which writes the caller's User-Agent (via getUserAgentInfo(), which returns unrecognized agent strings verbatim) directly into the `app` column of the videos_statistics table without invoking the sanitizing setter setApp(); normalizeApp() only truncates the value to 45 characters. The video owner's and administrator's statistics page (view/videoViewsInfo.php) renders this field in a DataTables 1.12.1 column with an unescaped renderer, and DataTables assigns cell content using innerHTML, so attacker-supplied HTML is parsed and executed in the privileged user's authenticated session when the statistics page is viewed. No patched version was available at the time of the advisory.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
WWBN AVideo 0 ~ 29.0 -

II. Public POCs for CVE-2026-92584

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-92584

请登录查看更多情报信息。

Other References for CVE-2026-92584 (2)

Same Patch Batch · WWBN · 2026-09-16 · 10 CVEs total

CVE-2026-92580 8.8 HIGH AVideo through 29.0 CloneSite Stored Shell Injection via SSH Password CSRF
CVE-2026-92578 8.1 HIGH WWBN AVideo through 29.0 Authentication Bypass via Stored Password Hash
CVE-2026-92577 7.5 HIGH AVideo through 29.0 API get_api_video Broken Access Control via clean_title
CVE-2026-92582 7.1 HIGH AVideo through 29.0 Broken Access Control via videoAddNew.json.php CSRF Bypass
CVE-2026-92583 6.5 MEDIUM AVideo through 29.0 Rate Limit Bypass via Non-Atomic Counter Increment
CVE-2026-92579 5.4 MEDIUM AVideo through 29.0 Broken Access Control via CSRF Exemption Basename Collision
CVE-2026-92585 4.3 MEDIUM AVideo through 29.0 Missing Authorization Check via API Like Endpoint
CVE-2026-92581 4.3 MEDIUM AVideo through 29.0 Like Counter Desynchronization via Array Parameter
CVE-2026-92586 4.3 MEDIUM AVideo through 29.0 Missing Authorization via comment API endpoint

IV. Related Vulnerabilities

Same product: AVideo
Same vendor: WWBN
Same weakness: CWE-79