The AVideo open-source video platform has security vulnerabilities in versions 29.0 and below that allow arbitrary HTML/JavaScript injection.

🚨 EUVD-2026-24539 📊 Score: 5.4/10 (CVSS v3.1) 📦 Product: AVideo 🏢 Vendor: WWBN 📅 Updated: 2026-04-21 📝 WWBN AVideo is an open source video platform. In versions 29.0 and below, the `isValidDuration()` regex at `objects/video.php:918` uses `/^[0-9]{1,2}:[0-9]{1,2}:[0-9]{1,2}/` without a `$` end anchor, allowing arbitrary HTML/JavaScript to be appended after a vali... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24539 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-24543 📊 Score: 5.4/10 (CVSS v3.1) 📦 Product: AVideo 🏢 Vendor: WWBN 📅 Updated: 2026-04-21 📝 WWBN AVideo is an open source video platform. In versions 29.0 and below, the incomplete XSS fix in AVideo's `ParsedownSafeWithLinks` class overrides `inlineMarkup` for raw HTML but does not override `inlineLink()` or `inlineUrlTag()`, allowing `javascript:` URL... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24543 #cybersecurity #infosec #euvd #cve #vulnerability