CVE-2026-84482 WWBN AVideo Cross-Site Request Forgery via get_domain() validation

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the getdomain and isSameDomain functions that fail to properly validate referer origins. Attackers can forge requests from sibling subdomains or unparseable long-gTLD origins to perform administrative...

PT-2026-84541

Name of the Vulnerable Software and Affected Versions AVideo versions prior to commit 9c39d8c8 Description Cross-site request forgery occurs because the get domain and isSameDomain functions fail to properly validate referer origins. This allows attackers to forge requests from sibling subdomains...