CVE-2026-84477
MEDIUM
NVD
CVSS Score
5.4
Severity
MEDIUM
Published
Sep 01, 2026
Vendor
unknown
Description
AVideo Live_schedule::setTitle() and setDescription() store POST input without sanitization, allowing users with streaming permission to inject malicious scripts. Unauthenticated attackers can access remindMe.php to execute stored XSS payloads in victim browsers without requiring authentication.