ETK-2026-3392Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-3392",
  "cve_id": null,
  "display_id": "ETK-2026-3392",
  "ghsa_id": "GHSA-vq8m-9xp3-76fg",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Stored cross-site scripting in AVideo embedded video links",
  "summary": "AVideo versions from 6.5 through at least 30.2 may store unsafe embedded-video links and render them in viewer pages. A user permitted to upload videos can cause script execution in the browser context of people who open the affected video, including administrators. Exploitation requires upload permission and an embedded video link to be viewed.",
  "mitigation": "Restrict video-upload and embedded-link creation permissions, and review or disable existing embedded video links until they have been validated. Enforce an allowlist of safe URL schemes when saving and rendering embed links; no fixed wwbn/avideo release is recorded.",
  "vendor": "composer",
  "product": "composer:wwbn/avideo",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 6.5"
      ],
      "ecosystem": "composer",
      "fixed_versions": [],
      "package_name": "wwbn/avideo",
      "purl": "pkg:composer/wwbn/avideo"
    }
  ],
  "cwes": [
    79
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 25.4081976,
  "t0_at": null,
  "signals": {
    "public_poc": {
      "at": "2026-11-01T23:19:20+00:00",
      "days": -1.846421538287037,
      "is_lower_bound": true,
      "measured_at": "2026-11-03T19:38:10.903273+00:00",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-vq8m-9xp3-76fg"
    },
    "trigger_signal": {
      "at": "2026-11-01T23:19:20+00:00",
      "days": -1.846421538287037,
      "is_lower_bound": true,
      "measured_at": "2026-11-03T19:38:10.903273+00:00",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-vq8m-9xp3-76fg"
    }
  }
}