Vulnerability-Lookup

CVE-2026-33499 (GCVE-0-2026-33499)

Vulnerability from cvelistv5 – Published: 2026-03-23 16:11 – Updated: 2026-03-23 17:42

Title

AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php

Summary

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `view/forbiddenPage.php` and `view/warningPage.php` templates reflect the `$_REQUEST['unlockPassword']` parameter directly into an HTML `<input>` tag's attributes without any output encoding or sanitization. An attacker can craft a URL that breaks out of the `value` attribute and injects arbitrary HTML attributes including JavaScript event handlers, achieving reflected XSS against any visitor who clicks the link. Commit f154167251c9cf183ce09cd018d07e9352310457 contains a patch.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M

References

2 references

URL	Tags
https://github.com/WWBN/AVideo/security/advisorie…	x_refsource_CONFIRM
https://github.com/WWBN/AVideo/commit/f154167251c…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
WWBN	AVideo	Affected: <= 26.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33499",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-23T17:42:06.040137Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-23T17:42:30.355Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "AVideo",
          "vendor": "WWBN",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 26.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `view/forbiddenPage.php` and `view/warningPage.php` templates reflect the `$_REQUEST[\u0027unlockPassword\u0027]` parameter directly into an HTML `\u003cinput\u003e` tag\u0027s attributes without any output encoding or sanitization. An attacker can craft a URL that breaks out of the `value` attribute and injects arbitrary HTML attributes including JavaScript event handlers, achieving reflected XSS against any visitor who clicks the link. Commit f154167251c9cf183ce09cd018d07e9352310457 contains a patch."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-23T16:11:57.528Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/WWBN/AVideo/security/advisories/GHSA-7292-w8qp-mhq2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-7292-w8qp-mhq2"
        },
        {
          "name": "https://github.com/WWBN/AVideo/commit/f154167251c9cf183ce09cd018d07e9352310457",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/WWBN/AVideo/commit/f154167251c9cf183ce09cd018d07e9352310457"
        }
      ],
      "source": {
        "advisory": "GHSA-7292-w8qp-mhq2",
        "discovery": "UNKNOWN"
      },
      "title": "AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33499",
    "datePublished": "2026-03-23T16:11:57.528Z",
    "dateReserved": "2026-03-20T16:59:08.888Z",
    "dateUpdated": "2026-03-23T17:42:30.355Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-33499",
      "date": "2026-07-09",
      "epss": "0.00231",
      "percentile": "0.13891"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-33499\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-03-23T17:16:51.180\",\"lastModified\":\"2026-06-17T10:37:36.393\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `view/forbiddenPage.php` and `view/warningPage.php` templates reflect the `$_REQUEST[\u0027unlockPassword\u0027]` parameter directly into an HTML `\u003cinput\u003e` tag\u0027s attributes without any output encoding or sanitization. An attacker can craft a URL that breaks out of the `value` attribute and injects arbitrary HTML attributes including JavaScript event handlers, achieving reflected XSS against any visitor who clicks the link. Commit f154167251c9cf183ce09cd018d07e9352310457 contains a patch.\"},{\"lang\":\"es\",\"value\":\"WWBN AVideo es una plataforma de video de c\u00f3digo abierto. En versiones hasta la 26.0 inclusive, las plantillas `view/forbiddenPage.php` y `view/warningPage.php` reflejan el par\u00e1metro `$_REQUEST[\u0027unlockPassword\u0027]` directamente en los atributos de una etiqueta HTML `` sin ninguna codificaci\u00f3n de salida o saneamiento. Un atacante puede crear una URL que escapa del atributo `value` e inyecta atributos HTML arbitrarios, incluyendo manejadores de eventos JavaScript, logrando XSS reflejado contra cualquier visitante que haga clic en el enlace. El commit f154167251c9cf183ce09cd018d07e9352310457 contiene un parche.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"WWBN\",\"product\":\"AVideo\",\"versions\":[{\"version\":\"\u003c= 26.0\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.7}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-03-23T17:42:06.040137Z\",\"id\":\"CVE-2026-33499\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"26.0\",\"matchCriteriaId\":\"774C24F1-9D26-484F-B931-1DA107C8F588\"}]}]}],\"references\":[{\"url\":\"https://github.com/WWBN/AVideo/commit/f154167251c9cf183ce09cd018d07e9352310457\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/WWBN/AVideo/security/advisories/GHSA-7292-w8qp-mhq2\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Mitigation\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-33499\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-23T17:42:06.040137Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-23T17:42:14.415Z\"}}], \"cna\": {\"title\": \"AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php\", \"source\": {\"advisory\": \"GHSA-7292-w8qp-mhq2\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 6.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"WWBN\", \"product\": \"AVideo\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c= 26.0\"}]}], \"references\": [{\"url\": \"https://github.com/WWBN/AVideo/security/advisories/GHSA-7292-w8qp-mhq2\", \"name\": \"https://github.com/WWBN/AVideo/security/advisories/GHSA-7292-w8qp-mhq2\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/WWBN/AVideo/commit/f154167251c9cf183ce09cd018d07e9352310457\", \"name\": \"https://github.com/WWBN/AVideo/commit/f154167251c9cf183ce09cd018d07e9352310457\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `view/forbiddenPage.php` and `view/warningPage.php` templates reflect the `$_REQUEST[\u0027unlockPassword\u0027]` parameter directly into an HTML `\u003cinput\u003e` tag\u0027s attributes without any output encoding or sanitization. An attacker can craft a URL that breaks out of the `value` attribute and injects arbitrary HTML attributes including JavaScript event handlers, achieving reflected XSS against any visitor who clicks the link. Commit f154167251c9cf183ce09cd018d07e9352310457 contains a patch.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-03-23T16:11:57.528Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-33499\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-23T17:42:30.355Z\", \"dateReserved\": \"2026-03-20T16:59:08.888Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-03-23T16:11:57.528Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-33499

Vulnerability from fkie_nvd - Published: 2026-03-23 17:16 - Updated: 2026-06-17 10:37

Severity

6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/WWBN/AVideo/commit/f154167251c9cf183ce09cd018d07e9352310457	Patch
	security-advisories@github.com	https://github.com/WWBN/AVideo/security/advisories/GHSA-7292-w8qp-mhq2	Exploit, Mitigation, Vendor Advisory

Impacted products

	Vendor	Product	Version
	wwbn	avideo	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "AVideo",
          "vendor": "WWBN",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 26.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "774C24F1-9D26-484F-B931-1DA107C8F588",
              "versionEndIncluding": "26.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `view/forbiddenPage.php` and `view/warningPage.php` templates reflect the `$_REQUEST[\u0027unlockPassword\u0027]` parameter directly into an HTML `\u003cinput\u003e` tag\u0027s attributes without any output encoding or sanitization. An attacker can craft a URL that breaks out of the `value` attribute and injects arbitrary HTML attributes including JavaScript event handlers, achieving reflected XSS against any visitor who clicks the link. Commit f154167251c9cf183ce09cd018d07e9352310457 contains a patch."
    },
    {
      "lang": "es",
      "value": "WWBN AVideo es una plataforma de video de c\u00f3digo abierto. En versiones hasta la 26.0 inclusive, las plantillas `view/forbiddenPage.php` y `view/warningPage.php` reflejan el par\u00e1metro `$_REQUEST[\u0027unlockPassword\u0027]` directamente en los atributos de una etiqueta HTML `` sin ninguna codificaci\u00f3n de salida o saneamiento. Un atacante puede crear una URL que escapa del atributo `value` e inyecta atributos HTML arbitrarios, incluyendo manejadores de eventos JavaScript, logrando XSS reflejado contra cualquier visitante que haga clic en el enlace. El commit f154167251c9cf183ce09cd018d07e9352310457 contiene un parche."
    }
  ],
  "id": "CVE-2026-33499",
  "lastModified": "2026-06-17T10:37:36.393",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-33499",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-03-23T17:42:06.040137Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-03-23T17:16:51.180",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/WWBN/AVideo/commit/f154167251c9cf183ce09cd018d07e9352310457"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-7292-w8qp-mhq2"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-7292-W8QP-MHQ2

Vulnerability from github – Published: 2026-03-20 20:56 – Updated: 2026-03-25 20:31

Summary

AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php

Details

Summary

The view/forbiddenPage.php and view/warningPage.php templates reflect the $_REQUEST['unlockPassword'] parameter directly into an HTML <input> tag's attributes without any output encoding or sanitization. An attacker can craft a URL that breaks out of the value attribute and injects arbitrary HTML attributes including JavaScript event handlers, achieving reflected XSS against any visitor who clicks the link.

Details

When a user visits a password-protected channel, view/channel.php:22 calls:

forbiddenPage('This channel is password protected', false, $channelPassword);

The forbiddenPage() function in objects/functionsSecurity.php:520 checks whether the supplied password matches. If it doesn't (or no password was submitted), it includes view/forbiddenPage.php at line 561.

In view/forbiddenPage.php:31-35, the raw request parameter is reflected into HTML:

$value = '';
if (!empty($_REQUEST['unlockPassword'])) {
    $value = $_REQUEST['unlockPassword'];  // Line 33: unsanitized user input
}
echo getInputPassword('unlockPassword', 'class="form-control" value="' . $value . '"', __('Unlock Password'));

The getInputPassword() function at objects/functions.php:4490 outputs the $attributes string directly into the <input> tag at line 4502:

<input id="<?php echo $id; ?>" name="<?php echo $id; ?>" type="password" placeholder="<?php echo $placeholder; ?>" <?php echo $attributes; ?>>

The unlockPassword parameter is not listed in any of the security filter arrays defined in objects/security.php:4-8 ($securityFilter, $securityFilterInt, $securityRemoveSingleQuotes, $securityRemoveNonChars, $securityRemoveNonCharsStrict, $filterURL), so it passes through the global input sanitization completely unfiltered.

Commit 3933d4abc added sanitization only for the server-side password comparison in functionsSecurity.php:529 (preg_replace('/[^0-9a-z]/i', '', ...)), but did not address the client-side reflection in the view templates.

The identical vulnerability exists in view/warningPage.php:31-34.

PoC

Step 1: Identify a password-protected channel (or any page that triggers forbiddenPage() with an $unlockPassword).

Step 2: Craft a URL with a malicious unlockPassword parameter that breaks out of the value attribute:

https://target.com/channel/someuser?unlockPassword=" autofocus onfocus="alert(document.cookie)

Step 3: The server renders the following HTML:

<input id="unlockPassword" name="unlockPassword" type="password"
  placeholder="Unlock Password"
  class="form-control" value="" autofocus onfocus="alert(document.cookie)">

The autofocus attribute causes the browser to immediately focus the input element on page load, triggering the onfocus event handler which executes the attacker-controlled JavaScript. No further user interaction is required beyond clicking the link.

Step 4: The JavaScript executes in the context of the target domain, with access to cookies (no CSP or HttpOnly protections were observed), DOM, and the ability to make authenticated requests on behalf of the victim.

Impact

Session hijacking: An attacker can steal PHPSESSID cookies and impersonate any user (including administrators) who clicks the crafted link.
Account takeover: The injected JavaScript can change the victim's email/password by submitting forms to the application's account settings endpoints.
Phishing: The attacker can overlay fake login forms or redirect users to credential harvesting pages.
No authentication required: The vulnerable page is specifically shown to unauthenticated/unauthorized users, making the attack surface broad.

Recommended Fix

Apply htmlspecialchars() output encoding to the reflected value in both view/forbiddenPage.php and view/warningPage.php:

view/forbiddenPage.php — change line 33:

// Before (vulnerable):
$value = $_REQUEST['unlockPassword'];

// After (fixed):
$value = htmlspecialchars($_REQUEST['unlockPassword'], ENT_QUOTES, 'UTF-8');

view/warningPage.php — change line 32:

// Before (vulnerable):
$value = $_REQUEST['unlockPassword'];

// After (fixed):
$value = htmlspecialchars($_REQUEST['unlockPassword'], ENT_QUOTES, 'UTF-8');

Alternatively, add 'unlockPassword' to the $securityFilter array in objects/security.php:4 to apply the global XSS filter, though explicit output encoding at the point of use is the more robust defense-in-depth approach.

Severity

6.1 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "wwbn/avideo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "26.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33499"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-20T20:56:38Z",
    "nvd_published_at": "2026-03-23T17:16:51Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe `view/forbiddenPage.php` and `view/warningPage.php` templates reflect the `$_REQUEST[\u0027unlockPassword\u0027]` parameter directly into an HTML `\u003cinput\u003e` tag\u0027s attributes without any output encoding or sanitization. An attacker can craft a URL that breaks out of the `value` attribute and injects arbitrary HTML attributes including JavaScript event handlers, achieving reflected XSS against any visitor who clicks the link.\n\n## Details\n\nWhen a user visits a password-protected channel, `view/channel.php:22` calls:\n```php\nforbiddenPage(\u0027This channel is password protected\u0027, false, $channelPassword);\n```\n\nThe `forbiddenPage()` function in `objects/functionsSecurity.php:520` checks whether the supplied password matches. If it doesn\u0027t (or no password was submitted), it includes `view/forbiddenPage.php` at line 561.\n\nIn `view/forbiddenPage.php:31-35`, the raw request parameter is reflected into HTML:\n```php\n$value = \u0027\u0027;\nif (!empty($_REQUEST[\u0027unlockPassword\u0027])) {\n    $value = $_REQUEST[\u0027unlockPassword\u0027];  // Line 33: unsanitized user input\n}\necho getInputPassword(\u0027unlockPassword\u0027, \u0027class=\"form-control\" value=\"\u0027 . $value . \u0027\"\u0027, __(\u0027Unlock Password\u0027));\n```\n\nThe `getInputPassword()` function at `objects/functions.php:4490` outputs the `$attributes` string directly into the `\u003cinput\u003e` tag at line 4502:\n```php\n\u003cinput id=\"\u003c?php echo $id; ?\u003e\" name=\"\u003c?php echo $id; ?\u003e\" type=\"password\" placeholder=\"\u003c?php echo $placeholder; ?\u003e\" \u003c?php echo $attributes; ?\u003e\u003e\n```\n\nThe `unlockPassword` parameter is **not listed** in any of the security filter arrays defined in `objects/security.php:4-8` (`$securityFilter`, `$securityFilterInt`, `$securityRemoveSingleQuotes`, `$securityRemoveNonChars`, `$securityRemoveNonCharsStrict`, `$filterURL`), so it passes through the global input sanitization completely unfiltered.\n\nCommit `3933d4abc` added sanitization only for the server-side password **comparison** in `functionsSecurity.php:529` (`preg_replace(\u0027/[^0-9a-z]/i\u0027, \u0027\u0027, ...)`), but did not address the client-side reflection in the view templates.\n\nThe identical vulnerability exists in `view/warningPage.php:31-34`.\n\n## PoC\n\n**Step 1:** Identify a password-protected channel (or any page that triggers `forbiddenPage()` with an `$unlockPassword`).\n\n**Step 2:** Craft a URL with a malicious `unlockPassword` parameter that breaks out of the `value` attribute:\n\n```\nhttps://target.com/channel/someuser?unlockPassword=\" autofocus onfocus=\"alert(document.cookie)\n```\n\n**Step 3:** The server renders the following HTML:\n\n```html\n\u003cinput id=\"unlockPassword\" name=\"unlockPassword\" type=\"password\"\n  placeholder=\"Unlock Password\"\n  class=\"form-control\" value=\"\" autofocus onfocus=\"alert(document.cookie)\"\u003e\n```\n\nThe `autofocus` attribute causes the browser to immediately focus the input element on page load, triggering the `onfocus` event handler which executes the attacker-controlled JavaScript. No further user interaction is required beyond clicking the link.\n\n**Step 4:** The JavaScript executes in the context of the target domain, with access to cookies (no CSP or HttpOnly protections were observed), DOM, and the ability to make authenticated requests on behalf of the victim.\n\n## Impact\n\n- **Session hijacking**: An attacker can steal `PHPSESSID` cookies and impersonate any user (including administrators) who clicks the crafted link.\n- **Account takeover**: The injected JavaScript can change the victim\u0027s email/password by submitting forms to the application\u0027s account settings endpoints.\n- **Phishing**: The attacker can overlay fake login forms or redirect users to credential harvesting pages.\n- **No authentication required**: The vulnerable page is specifically shown to unauthenticated/unauthorized users, making the attack surface broad.\n\n## Recommended Fix\n\nApply `htmlspecialchars()` output encoding to the reflected value in both `view/forbiddenPage.php` and `view/warningPage.php`:\n\n**view/forbiddenPage.php** \u2014 change line 33:\n```php\n// Before (vulnerable):\n$value = $_REQUEST[\u0027unlockPassword\u0027];\n\n// After (fixed):\n$value = htmlspecialchars($_REQUEST[\u0027unlockPassword\u0027], ENT_QUOTES, \u0027UTF-8\u0027);\n```\n\n**view/warningPage.php** \u2014 change line 32:\n```php\n// Before (vulnerable):\n$value = $_REQUEST[\u0027unlockPassword\u0027];\n\n// After (fixed):\n$value = htmlspecialchars($_REQUEST[\u0027unlockPassword\u0027], ENT_QUOTES, \u0027UTF-8\u0027);\n```\n\nAlternatively, add `\u0027unlockPassword\u0027` to the `$securityFilter` array in `objects/security.php:4` to apply the global XSS filter, though explicit output encoding at the point of use is the more robust defense-in-depth approach.",
  "id": "GHSA-7292-w8qp-mhq2",
  "modified": "2026-03-25T20:31:25Z",
  "published": "2026-03-20T20:56:38Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-7292-w8qp-mhq2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33499"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/commit/f154167251c9cf183ce09cd018d07e9352310457"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WWBN/AVideo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-33499 (GCVE-0-2026-33499)

FKIE_CVE-2026-33499

GHSA-7292-W8QP-MHQ2

Summary

Details

PoC

Impact

Recommended Fix

Tags

Sightings

Nomenclature