EUVD-2026-17630

WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's admin plugin configuration endpoint admin/save.json.php lacks any CSRF token validation. There is no call to isGlobalTokenValid or verifyToken before processing the request. Combined with the application's explicit...

EUVD-2022-5564

Malicious code in bioql PyPI...

Missing permission check in implied-labels allows reconfiguring the plugin

implied-labels 0.6 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to configure the plugin. implied-labels 0.7 requires Overall/Administer permission to configure the plugin...