CVE-2026-86719 WWBN AVideo CustomizeUser Cross-Site Request Forgery Session Hijacking

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 master contains a cross-site request forgery vulnerability in the CustomizeUser plugin endpoint plugin/CustomizeUser/swapUser.json.php. The endpoint takes usersid from $REQUEST and invokes User::swapUser without calling...

CVE-2026-86719

WWBN AVideo through commit c3edcc274c (master) is affected by a cross-site request forgery (CSRF) vulnerability in the CustomizeUser plugin at the endpoint plugin/CustomizeUser/swapUser.json.php. The endpoint reads users_id from $_REQUEST and calls User::swapUser() without CSRF protection, as the...

CVE-2026-86719 WWBN AVideo CustomizeUser Cross-Site Request Forgery Session Hijacking

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 master contains a cross-site request forgery vulnerability in the CustomizeUser plugin endpoint plugin/CustomizeUser/swapUser.json.php. The endpoint takes usersid from $REQUEST and invokes User::swapUser without calling...

PT-2026-87116

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 master contains a cross-site request forgery vulnerability in the CustomizeUser plugin endpoint plugin/CustomizeUser/swapUser.json.php. The endpoint takes users id from $ REQUEST and invokes User::swapUser without calling...