CVE-2026-33499 — Cross-site Scripting in Avideo
Severity
6.1MEDIUMNVD
EPSS
0.0%
top 98.50%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
Latest updateMar 20
PublishedMar 23
Description
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `view/forbiddenPage.php` and `view/warningPage.php` templates reflect the `$_REQUEST['unlockPassword']` parameter directly into an HTML `` tag's attributes without any output encoding or sanitization. An attacker can craft a URL that breaks out of the `value` attribute and injects arbitrary HTML attributes including JavaScript event handlers, achieving reflected XSS against any visitor who clicks the link. Co…
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7