https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 22 Oct 2026 11:42:51 +0000 https://cve.radiocsirt.org/vuln/cve-2026-33499 <p><strong>Affected:</strong> WWBN AVideo</p> <p>WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `view/forbiddenPage.php` and `view/warningPage.php` templates reflect the `$_REQUEST[&#39;unlockPassword&#39;]` parameter directly into an HTML `&lt;input&gt;` tag&#39;s attributes without any output encoding or sanitization. An attacker can craft a URL that breaks out of the `value` attribute and injects arbitrary HTML attributes including JavaScript event handlers, achieving reflected XSS against any visitor who clicks the link. Commit f154167251c9cf183ce09cd018d07e9352310457 contains a patch.</p> <p><strong>Affected:</strong> WWBN AVideo</p> <p>WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `view/forbiddenPage.php` and `view/warningPage.php` templates reflect the `$_REQUEST[&#39;unlockPassword&#39;]` parameter directly into an HTML `&lt;input&gt;` tag&#39;s attributes without any output encoding or sanitization. An attacker can craft a URL that breaks out of the `value` attribute and injects arbitrary HTML attributes including JavaScript event handlers, achieving reflected XSS against any visitor who clicks the link. Commit f154167251c9cf183ce09cd018d07e9352310457 contains a patch.</p> https://cve.radiocsirt.org/vuln/cve-2026-33499