THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-82646 (MEDIUM 6.1) — WWBN AVideo contains an unauthenticated reflected cross-site scripting vulnerability in the url2Embed.json.php endpoint that allows attackers to inject malicious scripts by supplying URLs with HTML metacharacters. Attackers can mint an encrypted evideo payload containing unescape

[NVD] CVE-2026-82646 (MEDIUM 6.1) — WWBN AVideo contains an unauthenticated reflected cross-site scripting vulnerability in the url2Embed.json.php endpoint that allows attackers to inject malicious scripts by supplying URLs with HTML metacharacters. Attackers can mint an encrypted evideo payload containing unescape

mednvdPublished 2026-08-30

CVE-2026-82646 CVSS: 6.1 MEDIUM Published: 2026-08-30T15:16:45.013

WWBN AVideo contains an unauthenticated reflected cross-site scripting vulnerability in the url2Embed.json.php endpoint that allows attackers to inject malicious scripts by supplying URLs with HTML metacharacters. Attackers can mint an encrypted evideo payload containing unescaped markup, then deliver it as a legitimate-looking li

MITRE ATT&CK techniques

JavaScriptT1059.007

Indicators of compromise

CVE-2026-82646cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-82646