VulnSocial

CVE-2026-41061General(wwbn / avideo)

LOWCVSS 5.4 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

WWBN AVideo is an open source video platform. In versions 29.0 and below, the `isValidDuration()` regex at `objects/video.php:918` uses `/^[0-9]{1,2}:[0-9]{1,2}:[0-9]{1,2}/` without a `$` end anchor, allowing arbitrary HTML/JavaScript to be appended after a valid duration prefix. The crafted duration is stored in the database and rendered without HTML escaping via `echo Video::getCleanDuration()` on trending pages, playlist pages, and video gallery thumbnails, resulting in stored cross-site scripting. Commit bcba324644df8b4ed1f891462455f1cd26822a45 contains a fix.

wwbn CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Exploit / PoC references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • avideo

Threat summary

  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 3 signals
  • General: 2 classified signals
  • Disclosure: 1 classified signal
  • Peaked at 2 mentions on most recent observed day (2026-04-25)
  • 3 total mentions across 2 days

Affected systems

Vendors
wwbn
Products
avideo

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-04-22: 1Mentions · 2026-04-25: 2Technical Details · 2026-04-22: 1Technical Details · 2026-04-25: 204-2204-25
Signal classification2 categories
General
266.7%
Disclosure
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-04-221
General1
2026-04-252
Disclosure1General1
Full discourse3 posts
  • Infoflowcloud@infoflowcloud
    General

    🚨*CVE* CVE-2026-41061 WWBN AVideo is an open source video platform. In versions 29.0 and below, the `isValidDuration()` regex at `objects/video.php:918` uses `/^[0-9]{1,2}:[0-9]{1,2}:[0-9]… https://www.cve.org/CVERecord?id=CVE-2026-41061 ----- Traducción: CVE-2026-41061 WWB… http://infoflow.cloud`

    Post summary

    The tweet cites CVE‑2026‑41061 in WWBN AVideo, noting a regex flaw in isValidDuration() within objects/video.php for versions 29.0 and earlier, and links to the CVE record.

    0000047
    72 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-41061 WWBN AVideo is an open source video platform. In versions 29.0 and below, the `isValidDuration()` regex at `objects/video.php:918` uses `/^[0-9]{1,2}:[0-9]{1,2}:[0-9]… https://www.cve.org/CVERecord?id=CVE-2026-41061

    Post summary

    The post announces CVE-2026-41061 for AVideo, detailing affected versions and a regex flaw in a specific file.

    00000209
    57.3K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    General

    CVE-2026-41061 Stored Cross-Site Scripting in WWBN AVideo 29.0 via Unanchored Duration Regex https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-41061

    Post summary

    The entry briefly lists CVE‑2026‑41061, describing a stored XSS vulnerability in WWBN AVideo 29.0 and linking to a vulnerability details page.

    0000042
    4.0K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appwwbnavideo---

Explore more

Back to dashboardwwbn CVEsavideo vulnerabilities