CVE-2026-85161

AVideo (through commit c91b5975d) contains a Cross-Site Request Forgery (CSRF) vulnerability in removePoster.php . The endpoint lacks forbidIfNotPost or forbidIfInvalidToken checks, allowing an attacker to craft malicious image tags that, when viewed by an authenticated victim, issue GET requests...