Stored XSS in AVideo User Group Management Interface

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in UserGroups::setGroup_name() that fails to sanitize group_name input. Administrators with canAdminUserGroups permission can inject malicious HTML and JavaScript that executes in the browser when other administrators access the user manager interface.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-89243 is a stored cross-site scripting vulnerability in WWBN AVideo's UserGroups::setGroup_name() function that fails to properly sanitize the group_name parameter. An administrator with canAdminUserGroups permissions can inject malicious HTML and JavaScript into group names, which then executes in the browsers of other administrators when they access the user manager interface. This vulnerability matters because it enables account takeover, credential theft, and lateral movement within administrative interfaces—high-value targets for attackers. While the CVSS score of 8.1 reflects the attack requiring administrative privileges, the stored nature of the payload creates persistent threats that affect all subsequent administrative users, making this a critical issue for multi-admin deployments.

Casky's 323 matching skills leverage Claude's extended reasoning to detect the attack patterns mapped to TA0001 (Initial Access) and TA0043 (Reconnaissance) by identifying suspicious parameter handling in UserGroups functions and analyzing data flows where user-controlled input reaches DOM manipulation points without validation. Practitioners using Casky would see findings highlighting the absence of output encoding in group name rendering, detection of script tag injection patterns in historical group configurations, and behavioral indicators showing administrator sessions with unusual script execution following group manager access. The platform's skills would also correlate permission-based access patterns (canAdminUserGroups) with subsequent administrative interface interactions, helping security teams prioritize remediation and audit logs for evidence of exploitation before patching.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-89243.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-89243

Casky has 323 skills that investigate the attack patterns behind CVE-2026-89243. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn