CVE-2026-50745

MediumCVSS 6.1/10Last modified Jun 29, 2026

Description

A missing sanitisation vulnerability exists with user input in the stats-video.php script. The way URLs to this script were constructed did not follow best practices, and the output of the Smarty custom helper function url was neither properly encoded nor sanitised, allowing user‑supplied input to be reflected without escaping.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jun 26, 2026
Last modified: Jun 29, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-5074610.0A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Connect Application to ex CVE-2026-507479.9A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found CVE-2026-507489.9A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Acce CVE-2026-507496.5Improper Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Any authenticated user can reject CVE-2026-50754.3The All in One SEO plugin for WordPress is vulnerable to Sensitive Information Exposure via 'internalOptions' localized script data in versi CVE-2026-507507.5Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. Following the fix for C CVE-2026-507519.3A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated r CVE-2026-507527.4A weakness in the certificate validation logic of the deprecated IKEv1 key exchange may allow an unauthenticated attacker positioned as a ma CVE-2026-507559.8An issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtain sensitive information via the X-Forwarded-For header value CVE-2026-507567.5An issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtain sensitive information via the x-ai-provider component CVE-2026-507577.8Directory Traversal vulnerability in DayuanJiang next-ai-draw-io 0.4.13 allowsa remote attacker to execute arbitrary code via the nex-ai-dra CVE-2026-507588.1Cross Site Scripting vulnerability in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to execute arbitrary code via the mcp para