CVE-2026-84477

Received Received - Intake

Stored XSS in AVideo Live via setTitle and setDescription

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: VulnCheck

Description

AVideo Live_schedule::setTitle() and setDescription() store POST input without sanitization, allowing users with streaming permission to inject malicious scripts. Unauthenticated attackers can access remindMe.php to execute stored XSS payloads in victim browsers without requiring authentication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-01

Generated

2026-09-02

AI Q&A

2026-09-02

EPSS Evaluated

N/A

NVD

CVE-2026-84477

EUVD

EUVD-2026-69719

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a stored cross-site scripting (XSS) flaw in AVideo's Live_schedule component. It occurs because the setTitle() and setDescription() functions store user-provided input without sanitization. Attackers with streaming permissions can inject malicious scripts, which are then executed in victim browsers when they access the remindMe.php page without requiring authentication.

Detection Guidance

Check AVideo application logs for unusual POST requests to Live_schedule::setTitle() or setDescription(). Inspect network traffic for requests to remindMe.php containing script tags or unexpected parameters. Use web application firewalls to monitor for XSS patterns in input fields.

Impact Analysis

Unauthenticated attackers can execute malicious scripts in your browser by exploiting this flaw. This could lead to session hijacking, theft of sensitive data like cookies or credentials, or unauthorized actions performed on your behalf while using the AVideo platform.

Compliance Impact

This vulnerability could violate GDPR by enabling unauthorized access to user data through script injection, potentially leading to data breaches. For HIPAA, it may expose protected health information if exploited in healthcare-related streaming contexts, risking non-compliance with security requirements.

Mitigation Strategies

Apply input validation and output encoding to setTitle() and setDescription(). Sanitize all user inputs in remindMe.php. Restrict streaming permissions to trusted users only. Update AVideo to the latest patched version if available.

Hi! I’m here to help you understand CVE-2026-84477. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70