CVE-2026-33683
CVE-2026-33683 · AVideo vulnerable to Stored XSS via html_entity_decode() Reversing xss_esc() Sanitization in Channel About Field
This page contains facts from public vulnerability sources. Check the original advisory before updating.
WWBN AVideo is an open source video platform. In versions up to and including 26.0, a sanitization order-of-operations flaw in the user profile "about" field allows any registered user to inject arbitrary JavaScript that executes when other users visit their channel page. The `xss_esc()` function entity-encodes input before `strip_specific_tags()` can match dangerous HTML tags, and `html_entity_decode()` on output reverses the encoding, restoring the raw malicious HTML. Commit 7cfdc380dae1e56bbb5de581470d9e9957445df0 contains a patch.
CVSS 5.4 · Medium · EPSS 0.2%
- Published
- Updated
Stack: php
Affected products and versions
avideo
- Versions
- <= 26.0: Affected
No fix published
wwbn/avideo Packagist
- Versions
- 10.4
- 10.8
- 11
- 11.1
- 11.1.1
- 11.5
- 11.6
- 12.4
- 14.3
- 14.3.1
- 14.4
- 18.0
- 21.0
- 22.0
- 24.0
- 25.0
- 26.0
- Affected ranges
- ECOSYSTEM: ≤ 26.0
No fix published