CVE-2026-33295 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

WWBN AVideo is an open source video platform. Prior to version 26.0, WWBN/AVideo contains a stored cross-site scripting vulnerability in the CDN plugin's downlo…
High CVSS: 8.2

CVE-2026-33295

WWBN AVideo is an open source video platform. Prior to version 26.0, WWBN/AVideo contains a stored cross-site scripting vulnerability in the CDN plugin's download buttons component. The `clean_title` field of a video record is interpolated directly into a JavaScript string literal without any escaping, allowing an attacker who can create or modify a video to inject arbitrary JavaScript that executes in the browser of any user who visits the affected download page. Version 26.0 fixes the issue.
Vendor
Wwbn
Product
Avideo
CWE
CWE-79
Yayın Tarihi
2026-03-22 17:17:09
Güncelleme
2026-03-24 17:53:43
Source Identifier
security-advisories@github.com
KEV Date Added
-

Kategoriler

CWE-79 Avideo HIGH Wwbn 2026

Referanslar

https://github.com/WWBN/AVideo/commit/30cdd825fa5778c1d678c2402be2413b84ee4833 https://github.com/WWBN/AVideo/security/advisories/GHSA-gc3m-4mcr-h3pv https://github.com/WWBN/AVideo/security/advisories/GHSA-gc3m-4mcr-h3pv