CVE-2026-89247
Received Received - Intake

XML Injection in AVideo Player via AD_Server Plugin

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: VulnCheck

Description
WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier contains an XML injection vulnerability in plugin/AD_Server/VMAP.php, which is reachable without authentication when the AD_Server plugin is enabled. The script emits Content-Type: application/xml and writes the timeOffset and idTag values returned by AD_Server::getVMAPSFromRequest() directly into VMAP attributes without encoding. Those values originate from the base64- and JSON-decoded $_REQUEST['vmaps'] parameter, which is not covered by $securityFilter in objects/security.php. A remote attacker can craft a vmaps value (containing a non-empty VAST.campaing entry) and induce a user to open the resulting VMAP URL or a video page using it, injecting arbitrary <vmap:AdBreak> and <vmap:AdTagURI>/AdSource nodes into the generated XML. The player's IMA path (afterVideoJS -> PlayerSkins::setIMAADTag) then requests the attacker-supplied ad URLs, resulting in ad injection and cross-origin requests from the victim's playback session. The issue was unfixed at the time of reporting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-89247
EUVD
EUVD-2026-76059

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wwbn avideo *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-91 The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-89247 is an XML injection vulnerability in WWBN AVideo affecting versions up to commit c3edcc274c389816d434acadac07ee78eaf330c1. The flaw exists in plugin/AD_Server/VMAP.php, which is accessible without authentication when the AD_Server plugin is enabled. Attackers can inject malicious XML nodes by crafting a vmaps parameter containing a non-empty VAST.campaing entry, leading to ad injection and cross-origin requests during video playback.

Detection Guidance

Check if the AD_Server plugin is enabled in your AVideo installation by inspecting the plugin directory for plugin/AD_Server/VMAP.php. Monitor network traffic for unexpected XML responses containing injected <vmap:AdBreak> or <vmap:AdTagURI> nodes from the VMAP endpoint.

Impact Analysis

This vulnerability allows attackers to inject unauthorized ads into video content viewed by users. It can also enable cross-origin requests from the victim's playback session, potentially exposing sensitive data or enabling further attacks. Users may see unexpected ads or experience altered video content without their consent.

Mitigation Strategies

Disable the AD_Server plugin if not required. If the plugin is necessary, apply input validation and output encoding to the vmaps parameter in plugin/AD_Server/VMAP.php. Use htmlspecialchars with ENT_QUOTES | ENT_XML1 and UTF-8 encoding for timeOffset and idTag values.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89247. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart