CVE-2026-33731 AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data

WWBN AVideo is an open source video platform. In versions prior to 29.0, the Authorize.Net webhook handler at plugin/AuthorizeNet/webhook.php contains a signature verification bypass that allows an attacker to forge webhook requests with arbitrary payment amounts and target user IDs. By supplying...

CVE-2026-33731

CVE-2026-33731 (AVideo) affects versions prior to 29.0. The webhook flaw in plugin/AuthorizeNet/webhook.php enables a signature verification bypass, allowing an attacker to forge webhook data and credit arbitrary wallet balances by using a legitimate transaction ID. The exploit chain combines: (1...

CVE-2025-24737 WordPress WP Helper Premium plugin <= 4.6.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Mat Bao Corporation WP Helper Premium allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects WP Helper Premium: from n/a through 4.6.1...

YYcms has a logic flaw vulnerability (CNVD-2020-58421)

YYCMS movie and television, rain rain CMS movie and television, is a fully automatic collection of video sites. YYcms there are logical flaws vulnerability, attackers can use the vulnerability without paying any fees to open VIP package year, time with their own definition...