CVE-2026-89246
MEDIUM
NVD
CVSS Score
5.4
Severity
MEDIUM
Published
Sep 11, 2026
Vendor
unknown
Description
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a CSV formula injection vulnerability in the myComments.download.php endpoint that fails to sanitize spreadsheet formula prefixes in comment text. Authenticated users can inject formulas starting with =, +, -, or @ characters that execute when administrators or video owners open the exported CSV file in spreadsheet applications.