{"id":"CVE-2026-84477","title":"AVideo Live_schedule::setTitle() and setDescription() store POST input without sanitization, allowing users with streaming permission to inject malicious scripts","summary":"AVideo Live_schedule::setTitle() and setDescription() store POST input without sanitization, allowing users with streaming permission to inject malicious scripts. Unauthenticated attackers can access remindMe.php to execute stored XSS pa…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-79"],"published":"2026-09-01","updated":"2026-09-08","sourceUpdated":"2026-09-08T20:18:59.270","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84477","references":[{"url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-625v-vrhq-g274","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/avideo-stored-xss-via-live-schedule-title-description","label":"disclosure@vulncheck.com"},{"url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-625v-vrhq-g274","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd"],"epss":0.00169,"epssPercentile":0.06669,"ingestedAt":"2026-09-08T21:11:12.289Z","slug":"CVE-2026-84477","body":"## Overview\n\nAVideo Live_schedule::setTitle() and setDescription() store POST input without sanitization, allowing users with streaming permission to inject malicious scripts. Unauthenticated attackers can access remindMe.php to execute stored XSS payloads in victim browsers without requiring authentication.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}