CVE-2026-92584 WWBN CVE debrief

Who should care

Defenders responsible for AVideo installations, especially those with publicly accessible view-counter endpoints, should assess exposure and prioritize verification of this vulnerability.

Why it matters

Defenders should prioritize verifying exposure of AVideo installations to this stored cross-site scripting vulnerability, especially those with publicly accessible view-counter endpoints, and assess the feasibility of exploitation in their environment. The vulnerability allows attacker-supplied HTML to be executed in privileged users' authenticated sessions, potentially impacting confidentiality, integrity, and functionality. Verification and potential patching or mitigation are necessary to prevent exploitation.

• Potential for attacker-supplied HTML to be executed in privileged users' authenticated sessions.
• Possible impact on the confidentiality and integrity of sensitive data.
• Potential disruption to video statistics and view counting functionality.
• Need for verification of AVideo installations and potential patching or mitigation.

Technical summary

The unauthenticated view-counter endpoint objects/videoAddViewCount.json.php in AVideo writes the caller's User-Agent directly into the `app` column of the videos_statistics table without sanitization. The video owner's and administrator's statistics page renders this field in a DataTables column with an unescaped renderer, allowing attacker-supplied HTML to be parsed and executed in the privileged user's authenticated session.

Defensive priority

Defenders should prioritize verifying exposure of AVideo installations to this vulnerability, especially those with publicly accessible view-counter endpoints, and assess the feasibility of exploitation in their environment.

Recommended defensive actions

• Verify AVideo installations for exposure to this vulnerability, especially those with publicly accessible view-counter endpoints.
• Assess the feasibility of exploitation in the environment.
• Monitor for potential exploitation attempts.
• Consider implementing compensating controls, such as web application firewalls or intrusion detection systems.
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description and CVSS score. However, no patched version was available at the time of the advisory, and the vendor's confidence is low.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.