CVE-2026-33507

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the "objects/pluginImport.json.php" endpoint allows admin users to upload and install plugin ZIP files containing executable PHP code, but lacks any CSRF protection. Combined with the application explicitly settin...

WWBN AVideo Cross-Site Request Forgery Vulnerability

WWBN AVideo is a video platform building system developed by the WWBN team using PHP. Versions of WWBN AVideo prior to 26.0 contained a cross-site request forgeing vulnerability. This vulnerability stemmed from the lack of CSRF protection on the pluginImport.json.php endpoint, which could lead to...

CVE-2026-33507: Cross-Site Request Forgery (CSRF)

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the objects/pluginImport.json.php endpoint allows admin users to upload and install plugin ZIP files containing executable PHP code, but lacks any CSRF protection. Combined with the application explicitly setting...