CVE-2026-33507 — Cross-Site Request Forgery in Avideo
Severity
8.8HIGHNVD
EPSS
0.1%
top 81.85%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
Latest updateMar 20
PublishedMar 23
Description
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/pluginImport.json.php` endpoint allows admin users to upload and install plugin ZIP files containing executable PHP code, but lacks any CSRF protection. Combined with the application explicitly setting `session.cookie_samesite = 'None'` for HTTPS connections, an unauthenticated attacker can craft a page that, when visited by an authenticated admin, silently uploads a malicious plugin containing a PHP…
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9