CVE-2026-49279 Details
Description
WWBN AVideo is an open source video platform. Versions 29.0 and below contain a Stored XSS vulnerability through the autoEvalCodeOnHTML parameter in the MessageSQLite WebSocket Handler. The MessageSQLite.php handler only strips autoEvalCodeOnHTML from $json['msg'], but msgToResourceId() reads from $msg['json'] with higher priority. An attacker can place the XSS payload in the json key instead of msg, bypassing the sanitization entirely. An authenticated attacker can execute arbitrary JavaScript in any connected user's browser session via the WebSocket messaging system, stealing session cookies and authentication tokens, taking over accounts through session hijacking, and chaining with CSRF to perform admin actions on the victim's behalf, in the default SQLite WebSocket backend configuration. This issue has a patch that has yet to be officially released, see https://github.com/WWBN/AVideo/commit/3e0b3ce2bfa766183ff0ae227439394db57b1a23.
A stored cross-site scripting vulnerability has been identified in WWBN AVideo versions through 14.3. The issue arises in the MessageSQLite WebSocket Handler, where the autoEvalCodeOnHTML parameter is not properly sanitized. An authenticated attacker can exploit this vulnerability by sending a WebSocket message that includes a JavaScript payload in the json key, bypassing the handler's sanitization process. This payload is then executed in the browser of any connected user, potentially leading to session hijacking and unauthorized actions on behalf of the victim, particularly in the default SQLite WebSocket backend configuration.
Users are advised to update to the patched version of AVideo, which includes the necessary fix. The update should apply the removeAutoEvalCodeOnHTMLRecursive function in the MessageSQLite.php file to ensure proper sanitization of the autoEvalCodeOnHTML parameter.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 15, 2026CISA-ADP
Assessed Jul 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WWBN/AVideo/security/advisories/GHSA-2fhx-q92v-5fhv | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/WWBN/AVideo/commit/3e0b3ce2bfa766183ff0ae227439394db57b1a23 | [email protected] | Source CodeVendor |
| https://github.com/WWBN/AVideo/security/advisories/GHSA-2fhx-q92v-5fhv | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WWBN AVideo | <= 14.3 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 18, 2026 | CVE Modified | CISA-ADP |
| Jul 15, 2026 | New CVE Received | [email protected] |