CVE-2026-33499
published 2026-03-23CVE-2026-33499: WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `view/forbiddenPage.php` and `view/warningPage.php` templates reflect…
PriorityP427medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.23%
13.9th percentile
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `view/forbiddenPage.php` and `view/warningPage.php` templates reflect the `$_REQUEST['unlockPassword']` parameter directly into an HTML `` tag's attributes without any output encoding or sanitization. An attacker can craft a URL that breaks out of the `value` attribute and injects arbitrary HTML attributes including JavaScript event handlers, achieving reflected XSS against any visitor who clicks the link. Commit f154167251c9cf183ce09cd018d07e9352310457 contains a patch.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| wwbn | avideo | <= 26.0 | — |
| wwbn | avideo | 0 – 26.0 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php
ghsa·2026-03-20
CVE-2026-33499 [MEDIUM] CWE-79 AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php
AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php
## Summary
The `view/forbiddenPage.php` and `view/warningPage.php` templates reflect the `$_REQUEST['unlockPassword']` parameter directly into an HTML `` tag's attributes without any output encoding or sanitization. An attacker can craft a URL that breaks out of the `value` attribute and injects arbitrary HTML attributes including JavaScript event handlers, achieving reflected XSS against any visitor who clicks the link.
## Details
When a user visits a password-protected channel, `view/channel.php:22` calls:
```php
forbiddenPage('This channel is password protected', false, $channelPassword);
```
The `forbiddenPage()` function in `objects/functionsSecurity.php:520` checks whether the supplied
OSV
AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php
osv·2026-03-20
CVE-2026-33499 [MEDIUM] AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php
AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php
## Summary
The `view/forbiddenPage.php` and `view/warningPage.php` templates reflect the `$_REQUEST['unlockPassword']` parameter directly into an HTML `` tag's attributes without any output encoding or sanitization. An attacker can craft a URL that breaks out of the `value` attribute and injects arbitrary HTML attributes including JavaScript event handlers, achieving reflected XSS against any visitor who clicks the link.
## Details
When a user visits a password-protected channel, `view/channel.php:22` calls:
```php
forbiddenPage('This channel is password protected', false, $channelPassword);
```
The `forbiddenPage()` function in `objects/functionsSecurity.php:520` checks whether the supplied
No detection rules found.
No public exploits indexed.
2026-03-23
Published