CVE-2026-58001

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in objects/videoEditLight.php that lacks request authenticity checks and accepts GET requests. Attackers can store an img tag in a video description that transfers video ownership to an attacker-controlled...

CVE-2026-58003

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the releaseVideoNow.json.php endpoint that lacks authenticity checks and accepts GET requests. Attackers can craft a malicious cross-site GET request carrying an administrator's session cookie to permanentl...

CVE-2026-57944

AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in channelToGallery.json.php that allows attackers to modify site-wide Gallery configuration by performing unauthorized writes to plugin data. Attackers can craft a cross-site GET request carrying an administrator'...

CVE-2026-59808

AVideo (through commit 9c39d8c8) is affected by an authentication bypass vulnerability. The root cause lies in deduplicateByEncoderQueueId(), which returns video_id_hash credentials for any video by encoder_queue_id without ownership verification , and useVideoHashOrLogin(), which converts this h...

CVE-2026-58003 WWBN AVideo Cross-Site Request Forgery via releaseVideoNow.json.php

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the releaseVideoNow.json.php endpoint that lacks authenticity checks and accepts GET requests. Attackers can craft a malicious cross-site GET request carrying an administrator's session cookie to permanentl...

CVE-2026-58003

WWBN AVideo through commit 9c39d8c8 is affected by a cross-site request forgery (CSRF) vulnerability in the releaseVideoNow.json.php endpoint. The endpoint lacks authenticity checks and accepts GET requests , allowing an attacker to craft a malicious cross-site GET request carrying an administrat...

CVE-2026-58003 WWBN AVideo Cross-Site Request Forgery via releaseVideoNow.json.php

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the releaseVideoNow.json.php endpoint that lacks authenticity checks and accepts GET requests. Attackers can craft a malicious cross-site GET request carrying an administrator's session cookie to permanentl...

CVE-2026-58003

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the releaseVideoNow.json.php endpoint that lacks authenticity checks and accepts GET requests. Attackers can craft a malicious cross-site GET request carrying an administrator's session cookie to permanentl...

CVE-2026-58003 WWBN AVideo Cross-Site Request Forgery via releaseVideoNow.json.php

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the releaseVideoNow.json.php endpoint that lacks authenticity checks and accepts GET requests. Attackers can craft a malicious cross-site GET request carrying an administrator's session cookie to permanentl...

EUVD-2026-64264

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the releaseVideoNow.json.php endpoint that lacks authenticity checks and accepts GET requests. Attackers can craft a malicious cross-site GET request carrying an administrator's session cookie to permanentl...

CVE-2026-58001 WWBN AVideo Cross-Site Request Forgery via videoEditLight.php

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in objects/videoEditLight.php that lacks request authenticity checks and accepts GET requests. Attackers can store an img tag in a video description that transfers video ownership to an attacker-controlled...

CVE-2026-58001 WWBN AVideo Cross-Site Request Forgery via videoEditLight.php

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in objects/videoEditLight.php that lacks request authenticity checks and accepts GET requests. Attackers can store an img tag in a video description that transfers video ownership to an attacker-controlled...

CVE-2026-58001 WWBN AVideo Cross-Site Request Forgery via videoEditLight.php

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in objects/videoEditLight.php that lacks request authenticity checks and accepts GET requests. Attackers can store an img tag in a video description that transfers video ownership to an attacker-controlled...

EUVD-2026-64262

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in objects/videoEditLight.php that lacks request authenticity checks and accepts GET requests. Attackers can store an img tag in a video description that transfers video ownership to an attacker-controlled...

CVE-2026-58001

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery (CSRF) vulnerability in objects/videoEditLight.php . The root cause is the absence of request authenticity checks combined with acceptance of GET requests , which enables state-changing operations via unauthenticated reques...

CVE-2026-58001

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in objects/videoEditLight.php that lacks request authenticity checks and accepts GET requests. Attackers can store an img tag in a video description that transfers video ownership to an attacker-controlled...

CVE-2026-57944

AVideo (through commit 9c39d8c8) is affected by a cross-site request forgery (CSRF) vulnerability in channelToGallery.json.php . The endpoint lacks token validation, allowing an attacker to craft a cross-site GET request carrying an administrator's session cookie to perform unauthorized writes to...

CVE-2026-57944 AVideo channelToGallery.json.php Cross-Site Request Forgery

AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in channelToGallery.json.php that allows attackers to modify site-wide Gallery configuration by performing unauthorized writes to plugin data. Attackers can craft a cross-site GET request carrying an administrator'...

CVE-2026-57944 AVideo channelToGallery.json.php Cross-Site Request Forgery

AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in channelToGallery.json.php that allows attackers to modify site-wide Gallery configuration by performing unauthorized writes to plugin data. Attackers can craft a cross-site GET request carrying an administrator'...

CVE-2026-57944

AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in channelToGallery.json.php that allows attackers to modify site-wide Gallery configuration by performing unauthorized writes to plugin data. Attackers can craft a cross-site GET request carrying an administrator'...