CVE-2026-34375
WWBN AVideo is an open source video platform.
Published Mar 27, 2026 · updated Jun 17, 2026 · wwbn avideo
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the YPTWallet Stripe payment confirmation page directly echoes the parameter into a JavaScript block without any encoding or sanitization. The parameter is not included in any of the framework's input filter lists defined in , so it passes through completely raw. An attacker can inject arbitrary JavaScript by crafting a malicious URL and sending it to a victim user. The same script block also outputs the current user's username and password hash via and , meaning a successful XSS exploitation can immediately exfiltrate these credentials. Commit fa0bc102493a15d79fe03f86c07ab7ca1b5b63e2 fixes the issue.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 27, 2026 · NIST NVD
Detected
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the YPTWallet Stripe payment confirmation page directly echoes the parameter into a JavaScript block without any encoding or sanitization. The parameter is not included in any of the framework's input filter lists defined in , so it passes through completely raw. An attacker can inject arbitrary JavaScript by craft
Jun 17, 2026 · NIST NVD
Updated
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the YPTWallet Stripe payment confirmation page directly echoes the parameter into a JavaScript block without any encoding or sanitization. The parameter is not included in any of the framework's input filter lists defined in , so it passes through completely raw. An attacker can inject arbitrary JavaScript by craft
Affected
- cpe wwbn/avideoversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-34375
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-34375
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the YPTWallet Stripe payment confirmation page directly echoes the parameter into a JavaScript block without any encoding or sanitization. The parameter is not inclu
nvd.nist.gov