CVE-2026-39367
WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo’s EPG (Electronic Program Guide) feature parses XML from user-controlled URLs and renders programme titles directly into HTML without any sanitization or escaping. A user with upload permission can set a video’s epg_link to a malicious XML file whose
More information : https://github.com/WWBN/AVideo/commit/e0212add4aad0f1e97758a4b4fdc57df58ce68e8
