CVE-2026-33499
Reflected XSS in WWBN AVideo Input Attributes (≤v
Publication date: 2026-03-23
Last updated on: 2026-03-24
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wwbn | avideo | to 26.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "CVE-2026-33499 is a reflected Cross-Site Scripting (XSS) vulnerability in the WWBN AVideo platform (versions up to 26.0). It occurs because the `unlockPassword` parameter from user requests is directly inserted into the HTML `<input>` element's value attribute without any encoding or sanitization."}, {'type': 'paragraph', 'content': "An attacker can craft a malicious URL containing specially crafted input for the `unlockPassword` parameter that breaks out of the input's value attribute and injects arbitrary HTML attributes and JavaScript event handlers. When a user clicks this link, the injected JavaScript executes in their browser."}, {'type': 'paragraph', 'content': 'This vulnerability affects the `view/forbiddenPage.php` and `view/warningPage.php` templates, allowing attackers to execute arbitrary scripts in the context of the vulnerable site.'}] [1]
How can this vulnerability impact me? :
This vulnerability can lead to several security impacts including:
- Session Hijacking: Attackers can steal session cookies and impersonate users, including administrators.
- Account Takeover: Malicious scripts can submit forms to change victim account details such as email or password.
- Phishing: Attackers can overlay fake login forms or redirect users to malicious credential harvesting pages.
- No Authentication Required: The vulnerable pages are accessible without authentication, increasing the attack surface.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by checking if the web application reflects the `unlockPassword` parameter unsanitized in the HTML input field on the `view/forbiddenPage.php` and `view/warningPage.php` pages.'}, {'type': 'paragraph', 'content': "One way to detect it is to craft a URL with a malicious `unlockPassword` parameter that attempts to break out of the input's value attribute and inject HTML or JavaScript, then observe if the payload is executed or reflected in the page source."}, {'type': 'list_item', 'content': 'Use curl or wget to send a request with a crafted `unlockPassword` parameter, for example: `curl \'https://target.com/channel/someuser?unlockPassword=" autofocus onfocus="alert(document.cookie)\'`'}, {'type': 'list_item', 'content': 'Inspect the response HTML for the presence of injected attributes or scripts in the password input field.'}, {'type': 'list_item', 'content': 'Alternatively, use a web vulnerability scanner that detects reflected XSS vulnerabilities by submitting payloads to the `unlockPassword` parameter and analyzing the response.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'The immediate mitigation step is to apply proper output encoding to the `unlockPassword` parameter before it is reflected in the HTML input field.'}, {'type': 'paragraph', 'content': "Specifically, update the code in `view/forbiddenPage.php` and `view/warningPage.php` to use PHP's `htmlspecialchars()` function with `ENT_QUOTES` and UTF-8 encoding on the `unlockPassword` parameter."}, {'type': 'list_item', 'content': "Replace the vulnerable code: `$value = $_REQUEST['unlockPassword'];`"}, {'type': 'list_item', 'content': "With the fixed code: `$value = htmlspecialchars($_REQUEST['unlockPassword'], ENT_QUOTES, 'UTF-8');`"}, {'type': 'paragraph', 'content': 'Alternatively, adding `unlockPassword` to the global input sanitization filter array can help, but output encoding at the point of use is preferred for defense-in-depth.'}, {'type': 'paragraph', 'content': 'Ensure that the application is updated to the patched version containing commit f154167251c9cf183ce09cd018d07e9352310457 which implements this fix.'}] [1, 2]