CVE-2026-33867

HighCVSS 7.5/10Last modified Oct 26, 2026

Description

WWBN AVideo is an open source video platform. In versions up to and including 26.0, AVideo allows content owners to password-protect individual videos. The video password is stored in the database in plaintext — no hashing, salting, or encryption is applied. If an attacker gains read access to the database (via SQL injection, a database backup, or misconfigured access controls), they obtain all video passwords in cleartext. Commit f2d68d2adbf73588ea61be2b781d93120a819e36 contains a patch.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-312

Affected software

Vendor	Product	Versions
WWBN	AVideo	<= 26.0

References

https://github.com/WWBN/AVideo/commit/f2d68d2adbf73588ea61be2b781d93120a819e36Patch
https://github.com/WWBN/AVideo/security/advisories/GHSA-363v-5rh8-23wgExploit, Vendor Advisory
https://github.com/WWBN/AVideo/security/advisories/GHSA-363v-5rh8-23wgExploit, Vendor Advisory

Timeline

Published: Mar 27, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-338686.1Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.8, 4.4.15, and 4.3.21, an unauthenticated CVE-2026-338694.8Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.5.x branch prior to 4.5.8 and on the 4.4.x CVE-2026-33875.5A vulnerability has been found in wren-lang wren up to 0.4.0. Affected by this issue is the function getByteCountForArguments of the file sr CVE-2026-338707.5Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly CVE-2026-338717.5Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can CVE-2026-338727.1elixir-nodejs provides an Elixir API for calling Node.js functions. A vulnerability in versions prior to 3.1.4 results in Cross-User Data Le CVE-2026-338739.9Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.9.0, the Agentic Assistant feature in Lang CVE-2026-338747.8Gematik Authenticator securely authenticates users for login to digital health applications. Starting in version 4.12.0 and prior to version CVE-2026-338759.3Gematik Authenticator securely authenticates users for login to digital health applications. Versions prior to 4.16.0 are vulnerable to auth CVE-2026-338773.7ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a timing side-channel vulnerability in CVE-2026-338799.8Federated Learning and Interoperability Platform (FLIP) is an open-source platform for federated training and evaluation of medical imaging CVE-2026-33885.5A vulnerability was found in Squirrel up to 3.2. This affects the function SQCompiler::Factor/SQCompiler::UnaryOP of the file squirrel/sqcom