CVE-2026-43880

🗓️ 11 May 2026 20:37:15Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 8 Views🌐 WEB

Unauthenticated attacker can send emails from the site to arbitrary recipients via sendEmail.json.php, enabling phishing.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2026-43880	27 Apr 202614:54	–	circl
CNNVD	WWBN AVideo 安全漏洞	11 May 202600:00	–	cnnvd
Cvelist	CVE-2026-43880 WWBN AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Allows Phishing from Site's Legitimate From Address	11 May 202620:37	–	cvelist
Github Security Blog	AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Enables Phishing from the Site’s Legitimate From Address	5 May 202621:56	–	github
NVD	CVE-2026-43880	11 May 202622:22	–	nvd
OSV	GHSA-5HGJ-7GM9-CFF5 AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Enables Phishing from the Site’s Legitimate From Address	5 May 202621:56	–	osv
Positive Technologies	PT-2026-37296	5 May 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-43880	5 Jun 202619:40	–	redhatcve
Snyk	Improper Verification of Source of a Communication Channel	5 May 202621:56	–	snyk
Vulnrichment	CVE-2026-43880 WWBN AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Allows Phishing from Site's Legitimate From Address	11 May 202620:37	–	vulnrichment

Vulners

Node

wwbn avideoRange≤29.0

[
  {
    "vendor": "WWBN",
    "product": "AVideo",
    "versions": [
      {
        "version": "<= 29.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/WWBN/AVideo/security/advisories/GHSA-5hgj-7gm9-cff5
github	www.github.com/WWBN/AVideo/commit/4e3709895857a5857f0edb46b0ee984de0d9e1a2

Parameter	Position	Path	Description	CWE
contactForm	path	objects/sendEmail.json.php	Unauthenticated open mail function allowing attacker to specify recipient email and use site SMTP to send emails, enabling phishing impersonation.	CWE-940

17 Jun 2026 10:50Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.15.3

EPSS0.00229

SSVC

CWE-940