CVE-2026-33766

WWBN AVideo is an open source video platform. In versions up to and including 26.0, "isSSRFSafeURL" validates URLs against private/reserved IP ranges before fetching, but "urlgetcontents" follows HTTP redirects without re-validating the redirect target. An attacker can bypass SSRF protection by...

CVE-2026-33766: Server-Side Request Forgery (SSRF)

WWBN AVideo is an open source video platform. In versions up to and including 26.0, isSSRFSafeURL validates URLs against private/reserved IP ranges before fetching, but urlgetcontents follows HTTP redirects without re-validating the redirect target. An attacker can bypass SSRF protection by...

CVE-2026-33294

WWBN AVideo is an open source video platform. Prior to version 26.0, the BulkEmbed plugin's save endpoint "plugin/BulkEmbed/save.json.php" fetches user-supplied thumbnail URLs via "urlgetcontents" without SSRF protection. Unlike all six other URL-fetching endpoints in AVideo that were hardened wi...

CVE-2026-33294: Server-Side Request Forgery (SSRF)

WWBN AVideo is an open source video platform. Prior to version 26.0, the BulkEmbed plugin's save endpoint plugin/BulkEmbed/save.json.php fetches user-supplied thumbnail URLs via urlgetcontents without SSRF protection. Unlike all six other URL-fetching endpoints in AVideo that were hardened with...

CVE-2026-33237: Server-Side Request Forgery (SSRF)

WWBN AVideo is an open source video platform. Prior to version 26.0, the Scheduler plugin's run function in plugin/Scheduler/Scheduler.php calls urlgetcontents with an admin-configurable callbackURL that is validated only by isValidURL URL format check. Unlike other AVideo endpoints that were...

CVE-2026-33237

WWBN AVideo is an open source video platform. Prior to version 26.0, the Scheduler plugin's "run" function in "plugin/Scheduler/Scheduler.php" calls "urlgetcontents" with an admin-configurable "callbackURL" that is validated only by "isValidURL" URL format check. Unlike other AVideo endpoints tha...