end anchor, allowing arbitrary HTML/JavaScript to be appended after a valid duration prefix. The crafted duratio" />
CVE-2026-41061 (CVSS 5.4 MEDIUM) - GotRooted
end anchor, allowing arbitrary HTML/JavaScript to be appended after a valid duration prefix. The crafted duratio" />
CVE-2026-41061 (CVSS 5.4 MEDIUM) - GotRootedCVE-2026-41061 (CVSS 5.4 MEDIUM) - GotRooted
end anchor, allowing arbitrary HTML/JavaScript to be appended after a valid duration prefix. The crafted duratio" />
CVE-2026-41061 (CVSS 5.4 MEDIUM) - GotRooted
end anchor, allowing arbitrary HTML/JavaScript to be appended after a valid duration prefix. The crafted duratio" />
end anchor, allowing arbitrary HTML/JavaScript to be appended after a valid duration prefix. The crafted duratio" />
end anchor, allowing arbitrary HTML/JavaScript to be appended after a valid duration prefix. The crafted duratio","inLanguage":"en-US","identifier":"CVE-2026-41061","datePublished":"2026-04-21T23:16:21.387","dateModified":"2026-10-26T21:10:00.170","about":{"@type":"Thing","name":"CVE-2026-41061","identifier":"CVE-2026-41061"},"isPartOf":{"@type":"WebSite","name":"GotRooted","url":"https://gotrooted.org/"},"publisher":{"@type":"Organization","name":"GotRooted","logo":{"@type":"ImageObject","url":"https://gotrooted.org/logo.png","width":640,"height":640}}},{"@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://gotrooted.org/"},{"@type":"ListItem","position":2,"name":"cve","item":"https://gotrooted.org/cve"},{"@type":"ListItem","position":3,"name":"CVE 2026 41061","item":"https://gotrooted.org/cve/CVE-2026-41061"}]}]}
WWBN AVideo is an open source video platform. In versions 29.0 and below, the `isValidDuration()` regex at `objects/video.php:918` uses `/^[0-9]{1,2}:[0-9]{1,2}:[0-9]{1,2}/` without a `
CVE-2026-41061 (CVSS 5.4 MEDIUM) - GotRootedCVE-2026-41061 (CVSS 5.4 MEDIUM) - GotRooted
end anchor, allowing arbitrary HTML/JavaScript to be appended after a valid duration prefix. The crafted duratio" />
CVE-2026-41061 (CVSS 5.4 MEDIUM) - GotRooted
end anchor, allowing arbitrary HTML/JavaScript to be appended after a valid duration prefix. The crafted duratio" />
CVE-2026-41061 (CVSS 5.4 MEDIUM) - GotRootedCVE-2026-41061 (CVSS 5.4 MEDIUM) - GotRooted
end anchor, allowing arbitrary HTML/JavaScript to be appended after a valid duration prefix. The crafted duratio" />
CVE-2026-41061 (CVSS 5.4 MEDIUM) - GotRooted
end anchor, allowing arbitrary HTML/JavaScript to be appended after a valid duration prefix. The crafted duratio" />
end anchor, allowing arbitrary HTML/JavaScript to be appended after a valid duration prefix. The crafted duratio" />
end anchor, allowing arbitrary HTML/JavaScript to be appended after a valid duration prefix. The crafted duratio","inLanguage":"en-US","identifier":"CVE-2026-41061","datePublished":"2026-04-21T23:16:21.387","dateModified":"2026-10-26T21:10:00.170","about":{"@type":"Thing","name":"CVE-2026-41061","identifier":"CVE-2026-41061"},"isPartOf":{"@type":"WebSite","name":"GotRooted","url":"https://gotrooted.org/"},"publisher":{"@type":"Organization","name":"GotRooted","logo":{"@type":"ImageObject","url":"https://gotrooted.org/logo.png","width":640,"height":640}}},{"@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://gotrooted.org/"},{"@type":"ListItem","position":2,"name":"cve","item":"https://gotrooted.org/cve"},{"@type":"ListItem","position":3,"name":"CVE 2026 41061","item":"https://gotrooted.org/cve/CVE-2026-41061"}]}]}
end anchor, allowing arbitrary HTML/JavaScript to be appended after a valid duration prefix. The crafted duration is stored in the database and rendered without HTML escaping via `echo Video::getCleanDuration()` on trending pages, playlist pages, and video gallery thumbnails, resulting in stored cross-site scripting. Commit bcba324644df8b4ed1f891462455f1cd26822a45 contains a fix.