CVE-2026-43880

WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/sendEmail.json.php exposes two branches depending on whether contactForm=1 is submitted. When the parameter is omitted, the endpoint sets $sendTo to an attacker-supplied email and, for unauthenticated...

CVE-2026-43880

creationtimestamp| type| source ---|---|--- 2026-04-27 14:54:44+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-5hgj-7gm9-cff5...