CVE-2026-43876 Details
Description
WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/notifySubscribers.json.php takes the raw message POST parameter and passes it into sendSiteEmail(), which substitutes it directly into an HTML email template (via str_replace on the {message} placeholder) and renders it with PHPMailer::msgHTML(). There is no HTML sanitization, character escaping, or output encoding on the attacker-controlled message between $_POST['message'] and the rendered email. Any authenticated user with upload permission can therefore broadcast arbitrary HTML — phishing links, tracking pixels, CSS/UI spoofing — to every subscriber on their channel (up to 10,000 recipients per invocation). The email is sent From: the platform's configured contact address and wrapped in the site's official logo and title, so attacker-supplied HTML arrives with the appearance of an official platform communication. Commit https://github.com/WWBN/AVideo/commit/ contains an updated fix.
A vulnerability in WWBN AVideo versions through 29.0 allows authenticated users with upload permissions to inject arbitrary HTML into email notifications sent to their channel subscribers. The issue arises in the 'objects/notifySubscribers.json.php' file, where the 'message' POST parameter is passed directly to the 'sendSiteEmail()' function without any HTML sanitization or encoding. This unsanitized HTML is then rendered as an email using PHPMailer's 'msgHTML()' method. As a result, an attacker can broadcast phishing links, tracking pixels, or UI spoofing elements to up to 10,000 subscribers per request. The emails are sent from the platform's contact address, disguised as official communications, and include the site's logo and title.
Sanitize or encode the 'message' POST parameter before it is processed by PHPMailer. This can be done by stripping all HTML and converting the message to plain text, or by using a trusted HTML sanitizer to allow only a limited set of HTML elements. Additionally, implement measures such as requiring a real anti-CSRF token, adding rate limits, and including an unsubscribe option in the email notifications.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 11, 2026CISA-ADP
Assessed May 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WWBN/AVideo/security/advisories/GHSA-g9cm-rxp7-6gv5 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/WWBN/AVideo/commit/078c4342eb9969a70425a9cdca3eefa7f8a86d53 | [email protected] | Source CodeVendor |
| https://github.com/WWBN/AVideo/security/advisories/GHSA-g9cm-rxp7-6gv5 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WWBN AVideo | <= 29.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 13, 2026 | CVE Modified | CISA-ADP |
| May 11, 2026 | New CVE Received | [email protected] |