CVE-2026-40929 WWBN AVideo's missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creators

WWBN AVideo is an open source video platform. In versions 29.0 and prior, objects/commentDelete.json.php is a state-mutating JSON endpoint that deletes comments but performs no CSRF validation. It does not call forbidIfIsUntrustedRequest, does not verify a CSRF/global token, and does not check...

CVE-2012-4470

The Listhandler module 6.x-1.x before 6.x-1.1 for Drupal does not properly check permissions when importing emails, which allows remote comment authors to bypass access restrictions and possibly have other unspecified impact...

CVE-2012-4470

The vulnerability CVE-2012-4470 affects the Listhandler module for Drupal (versions 6.x-1.x prior to 6.x-1.1). The root cause is an improper permissions check when importing emails, allowing remote comment authors to bypass access restrictions. This could enable unintended access or other unspeci...