EUVD-2026-81282
GHSA-x968-qj2r-r49p
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Classic CSRF: attacker needs no account (PR:N) but a victim must be authenticated and click a crafted page (UI:R); impact is chiefly record integrity (I:H) with limited confidentiality (C:L) and no availability effect.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
4DescriptionCVE.org
AVideo (WWBN/AVideo) through 29.0 (commit e01e41ecc) is vulnerable to cross-site request forgery. objects/videoAddNew.json.php disables AVideo's automatic CSRF guard ($global['skipAutoCSRFCheck']) and the untrusted-request check ($global['bypassSameDomainCheck']) merely because 'user' and 'pass' parameters are present in the request; the values are never validated and are read from $_REQUEST, so an attacker can supply them in the query string of a cross-site request. Because User::loginFromRequestIfNotLogged() returns immediately when a session already exists, a victim who is authenticated by cookie satisfies the check while the attacker-supplied credentials are discarded. An attacker who lures an authenticated user with upload rights to visit a crafted page can therefore submit cross-origin requests that modify video records - including ownership transfer (setUsers_id), deletion of user-group access restrictions, can_download, can_share, only_for_paid, video_password, rating, status, creation date, and view count. For a victim with administrator or Permissions::canAdminVideos() rights, any video on the site can be altered, including removing group restrictions from private content. No patched version was available at the time of the advisory.
AnalysisAI
Cross-site request forgery in AVideo (WWBN/AVideo) through 29.0 lets an attacker who lures an authenticated, upload-capable user to a crafted page fire cross-origin requests at objects/videoAddNew.json.php and silently rewrite video records. The endpoint disables AVideo's automatic CSRF guard and same-domain check whenever 'user' and 'pass' parameters merely appear in $_REQUEST, and because User::loginFromRequestIfNotLogged() returns early for an existing session, those attacker-supplied credentials are never validated and are simply discarded. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a victim who is already authenticated to the AVideo instance by session cookie AND holds video-upload rights (with maximal impact when the victim has administrator or Permissions::canAdminVideos() rights, enabling modification of any video site-wide). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a CSRF (CWE-352) broken-access-control flaw in AVideo's videoAddNew.json.php, scored 7.1 by the vendor under CVSS 4.0 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch was identified at time of analysis, so readiness to upgrade should be tracked against GHSA-qf9p-jhx7-rhmf (https://github.com/WWBN/AVideo/security/advisories/GHSA-qf9p-jhx7-rhmf) and the VulnCheck advisory (https://www.vulncheck.com/advisories/avideo-through-29.0-broken-access-control-via-videoaddnew-json-php-csrf-bypass), applying the first fixed release as soon as WWBN publishes one. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all AVideo deployments at or below version 29.0 and treat them as exposed, noting that no public exploit code was identified at time of analysis; block or restrict external and cross-origin access to objects/videoAddNew.json.php at the WAF or reverse proxy, require Origin/Referer validation and SameSite=Strict session cookies, and immediately audit recent video records for unexpected changes to ownership (users_id), status, creation date, view count, rating, can_download, can_share, only_for_paid, video_password, and user-group access restrictions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today