{"id":"CVE-2026-33035","aliases":["GHSA-wfq5-qgqp-hvhv"],"url":"https://o3.security/vulnerability/CVE-2026-33035","summary":"Unauthenticated Reflected XSS via innerHTML in AVideo","details":"## Summary\n\nAVideo contains a reflected XSS vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser. User input from a URL parameter flows through PHP's `json_encode()` into a JavaScript function that renders it via `innerHTML`, bypassing encoding and achieving full script execution.\n\n\n## Root Cause\nThe vulnerability is caused by two issues working together:\n\n### 1. Source: Unescaped user input passed to JavaScript (videoNotFound.php)\n\n**File:** `view/videoNotFound.php` line 49\n\n```php\nif (!empty($_REQUEST['404ErrorMsg'])) {\n echo 'avideoAlertInfo(' . json_encode($_REQUEST['404ErrorMsg']) . ');';\n}\n```\n\nPHP's `json_encode()` with default flags only escapes quotes (`\"` → `\\\"`) and backslashes. It does **NOT** escape HTML special characters (`<`, `>`, `/`). The resulting string contains raw HTML tags that are passed directly to JavaScript.\n\n### 2. Sink: innerHTML renders HTML tags as executable DOM (script.js)\n\n**File:** `view/js/script.js`\n\n```javascript\nfunction avideoAlertInfo(msg) { // line ~1891\n avideoAlert(\"\", msg, 'info'); // calls ↓\n}\n\nfunction avideoAlert(title, msg, type) { // line ~1270\n avideoAlertHTMLText(title, msg, type); // calls ↓\n}\n\nfunction avideoAlertHTMLText(title, msg, type) { // line ~1451\n var span = document.createElement(\"span\");\n span.innerHTML = msg; // line 1464 — XSS SINK\n swal({ content: span });\n}\n```\n\n`innerHTML` parses the string as HTML. Any ``, `