Home / Vulnerability Intelligence / CVE-2026-33499

CVE-2026-33499 - Vulnerability Analysis

MediumCVSS: 6.1

Last Updated: March 24, 2026

WWBN AVideo - Reflected XSS

Published: March 23, 2026Updated: March 24, 2026PoC AvailableRemote Exploitable

Overview

WWBN AVideo <= 26.0 contains a reflected XSS caused by unsanitized reflection of the 'unlockPassword' parameter in HTML input attributes in view/forbiddenPage.php and view/warningPage.php, letting attackers inject arbitrary HTML/JS, exploit requires victim to click crafted URL.

Severity & Score

Severity: Medium

CVSS Score: 6.1

Impact

Attackers can execute arbitrary JavaScript in victims' browsers, leading to session hijacking or other client-side attacks.

Mitigation

Update to a version including commit f154167251c9cf183ce09cd018d07e9352310457 or later.

References

Related Resources

Details

CVE ID: CVE-2026-33499
Severity: Medium
CVSS Score: 6.1
Type: reflected_xss
Status: confirmed

CWE

CWE-79

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N