Medium severity6.1NVD Advisory· Published Mar 23, 2026· Updated Jun 17, 2026
CVE-2026-33499
CVE-2026-33499
Description
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the view/forbiddenPage.php and view/warningPage.php templates reflect the $_REQUEST['unlockPassword'] parameter directly into an HTML ` tag's attributes without any output encoding or sanitization. An attacker can craft a URL that breaks out of the value` attribute and injects arbitrary HTML attributes including JavaScript event handlers, achieving reflected XSS against any visitor who clicks the link. Commit f154167251c9cf183ce09cd018d07e9352310457 contains a patch.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
wwbn/avideoPackagist | <= 26.0 | — |
Affected products
3Patches
Vulnerability mechanics
References
4- github.com/WWBN/AVideo/commit/f154167251c9cf183ce09cd018d07e9352310457nvdPatchWEB
- github.com/WWBN/AVideo/security/advisories/GHSA-7292-w8qp-mhq2nvdExploitMitigationVendor AdvisoryWEB
- github.com/advisories/GHSA-7292-w8qp-mhq2ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-33499ghsaADVISORY
News mentions
0No linked articles in our index yet.