PT-2026-27186 · Avideo · Avideo

Restriction · Publicado 2026-03-23 · Atualizado 2026-03-25 · CVE-2026-33683

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions AVideo versions up to and including 26.0

Description A flaw exists in the order of operations during sanitization of the user profile "about" field. This allows any registered user to inject arbitrary JavaScript that executes when other users visit their channel page. The xss esc() function entity-encodes input before the strip specific tags() function can identify and remove dangerous HTML tags. Subsequently, the html entity decode() function reverses the encoding on output, restoring the original malicious HTML.

Recommendations Update to a version after 26.0.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-33683

GHSA-GHX5-7JJG-Q2J7

Produtos afetados

Avideo

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33683.json · Exploit
• https://github.com/WWBN/AVideo · Nota
• https://github.com/WWBN/AVideo/security/advisories/GHSA-ghx5-7jjg-q2j7 · Aviso do Fabricante
• https://github.com/WWBN/AVideo/commit/7cfdc380dae1e56bbb5de581470d9e9957445df0 · Correção
• https://osv.dev/vulnerability/GHSA-ghx5-7jjg-q2j7 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-33683 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-33683 · Aviso do Fabricante