CVE-2026-33035

WWBN AVideo is an open source video platform. In versions 25.0 and below, there is a reflected XSS vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser. User input from a URL parameter flows through PHP's json_encode() into a JavaScript function that renders it via innerHTML, bypassing encoding and achieving full script execution. The vulnerability is caused by two issues working together: unescaped user input passed to JavaScript (videoNotFound.php), and innerHTML rendering HTML tags as executable DOM (script.js). The attack can be escalated to steal session cookies, take over accounts, phish credentials via injected login forms, spread self-propagating payloads, and compromise admin accounts — all by exploiting the lack of proper input sanitization and cookie security (e.g., missing HttpOnly flag on PHPSESSID). The issue has been fixed in version 26.0.

• CWE-79

• https://github.com/WWBN/AVideo/commit/cca6196f4072cb9acc39b1030fb8fb1702b4f69bPatch
• https://github.com/WWBN/AVideo/security/advisories/GHSA-wfq5-qgqp-hvhvExploit, Vendor Advisory

Published

Mar 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33029Nginx UI is a web user interface for the Nginx web server. P…6.5
• CVE-2026-33030Nginx UI is a web user interface for the Nginx web server. I…9.9
• CVE-2026-33031Nginx UI is a web user interface for the Nginx web server. P…8.1
• CVE-2026-33032Nginx UI is a web user interface for the Nginx web server. I…9.8
• CVE-2026-33033An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.…6.5
• CVE-2026-33034An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.…7.5
• CVE-2026-33036fast-xml-parser allows users to process XML from JS object w…7.5
• CVE-2026-33037WWBN AVideo is an open source video platform. In versions 25…8.1
• CVE-2026-33038WWBN AVideo is an open source video platform. Versions 25.0 …8.1
• CVE-2026-33039WWBN AVideo is an open source video platform. In versions 25…8.6
• CVE-2026-3304Multer is a node.js middleware for handling `multipart/form-…7.5
• CVE-2026-33040libp2p-rust is the official rust language Implementation of …7.5