EUVD-2026-277010

fkie_cve-2026-33499

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `view/forbiddenPage.php` and `view/warningPage.php` templates reflect the `$_REQUEST['unlockPassword']` parameter directly into an HTML `<input>` tag's attributes without any output encoding or sanitization. An attacker can craft a URL that breaks out of the `value` attribute and injects arbitrary HTML attributes including JavaScript event handlers, achieving reflected XSS against any visitor who clicks the link. Commit f154167251c9cf183ce09cd018d07e9352310457 contains a patch.

GHSA-7292-w8qp-mhq2 — AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php

Affected: Packagist: wwbn/avideo

## Summary

The `view/forbiddenPage.php` and `view/warningPage.php` templates reflect the `$_REQUEST['unlockPassword']` parameter directly into an HTML `<input>` tag's attributes without any output encoding or sanitization. An attacker can craft a URL that breaks out of the `value` attribute and injects arbitrary HTML attributes including JavaScript event handlers, achieving reflected XSS against any visitor who clicks the link.

## Details

When a user visits a password-protected channel, `view/channel.php:22` calls: ```php forbiddenPage('This channel is password protected', false, $channelPassword); ```

The `forbiddenPage()` function in `objects/functionsSecurity.php:520` checks whether the supplied password matches. If it doesn't (or no password was submitted), it includes `view/forbiddenPage.php` at line 561.

In `view/forbiddenPage.php:31-35`, the raw request parameter is reflected into HTML: ```php $value = ''; if (!empty($_REQUEST['unlockPassword'])) { $value = $_REQUEST['unlockPassword']; // Line 33: unsanitized user input } echo getInputPassword('unlockPassword', 'class="form-control" value="' . $value . '"', __('Unlock Password')); ```

The `getInputPassword()` function at `objects/functions.php:4490` outputs the `$attributes` string directly into the `<input>` tag at line 4502: ```php <input id="<?php echo $id; ?>" name="<?php echo $id; ?>" type="password" placeholder="<?php echo $placeholder; ?>" <?php echo $attributes; ?>> ```

The `unlockPassword` paramet…

Most recent entries from all

EUVD-2026-277010

fkie_cve-2026-33499

GHSA-7292-w8qp-mhq2 — AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php