5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33035

CVE-2026-33035: Unauthenticated Reflected XSS via innerHTML in AVideo

WWBN AVideo is an open source video platform. In versions 25.0 and below, there is a reflected XSS vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser. User input from a URL parameter flows through PHP's json_encode() into a JavaScript function that renders it via innerHTML, bypassing encoding and achieving full script execution. The vulnerability is caused by two issues working together: unescaped user input passed to JavaScript (videoNotFound.php), and innerHTML rendering HTML tags as executable DOM (script.js). The attack can be escalated to steal session cookies, take over accounts, phish credentials via injected login forms, spread self-propagating payloads, and compromise admin accounts — all by exploiting the lack of proper input sanitization and cookie security (e.g., missing HttpOnly flag on PHPSESSID). The issue has been fixed in version 26.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33035

CVE-2026-33035:

5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
wwbn/avideo	composer	<= 25.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic reflected Cross-Site Scripting (XSS) attack. The root cause is twofold, involving both server-side and client-side code.

Server-Side Source: The PHP script view/videoNotFound.php takes user input from the 404ErrorMsg URL parameter and directly embeds it into a JavaScript function call. It uses json_encode() without the necessary flags (JSON_HEX_TAG, JSON_HEX_AMP) to escape characters that have special meaning in HTML, such as < and >. This allows an attacker to inject raw HTML tags into the string passed to the client.
Client-Side Sink: The injected string is passed to the avideoAlertInfo() JavaScript function. This function, in turn, calls a series of other functions (avideoAlert() -> avideoAlertHTMLText()) that ultimately use the innerHTML property to render the message in the browser. Because innerHTML parses and executes HTML, any malicious script embedded in the user-provided string (e.g., via an <img onerror=...> tag) is executed in the context of the victim's browser session.

The patch addresses the vulnerability comprehensively. On the server side, it adds the JSON_HEX_TAG, JSON_HEX_AMP, JSON_HEX_APOS, and JSON_HEX_QUOT flags to json_encode in videoNotFound.php to properly escape the input. On the client side, it refactors all the alert-related JavaScript functions in view/js/script.js to use the safe textContent property by default, instead of the dangerous innerHTML property, thus preventing the rendering of injected HTML.

Vulnerable functions

avideoAlertHTMLText

view/js/script.js

This function was a primary sink for the XSS vulnerability. It directly assigned a user-controllable string to the `innerHTML` property of a DOM element without prior sanitization, allowing arbitrary HTML and script execution.

avideoAlertWithCookie

view/js/script.js

This function contained a vulnerable code path where it assigned a message directly to `innerHTML`, creating an XSS sink. The patch replaces this with a call to a new function that uses the safe `textContent` property by default.

avideoConfirm

view/js/script.js

This function used `innerHTML` to render a confirmation message, which could be controlled by an attacker to execute script. The patch replaces the unsafe assignment with a call to a new function that defaults to using the safe `textContent` property.

avideoAlertOnceForceConfirm

view/js/script.js

This function directly assigned a message to `innerHTML`, creating an XSS sink. The patch mitigates this by replacing the `innerHTML` assignment with a call to a new, safer function that uses `textContent`.

avideoAlertInfo

view/js/script.js

This function serves as the initial entry point for the user-provided payload into the JavaScript execution flow. While it doesn't contain the `innerHTML` sink itself, it receives the tainted data and passes it down the call stack to the vulnerable rendering function. It would appear in any runtime profile of the exploit.

avideoAlert

view/js/script.js

This function acted as an intermediary in the primary exploit chain. In the vulnerable version, it received the tainted message and passed it directly to `avideoAlertHTMLText`, which contained the `innerHTML` sink. The patch reroutes the call to a safe function.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.