CRITICAL🇵🇱 Wersja polska

CVE-2026-33351

CVSS 9.1v3.1pub. 2026-03-23

WWBN AVideo is an open source video platform. Prior to version 26.0, a Server-Side Request Forgery (SSRF) vulnerability exists in `plugin/Live/standAloneFiles/saveDVR.json.php`. When the AVideo Live plugin is deployed in standalone mode (the intended configuration for this file), the `$_REQUEST['webSiteRootURL']` parameter is used directly to construct a URL that is fetched server-side via `file_get_contents()`. No authentication, origin validation, or URL allowlisting is performed. Version 26.0 contains a patch for the issue.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

  • Wwbn Avideo

    APP
    Wwbn
    < 26.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
SSRF
CWE
References

Related vulnerabilities

CVE-2026-41064CRITICAL9.3PL ✓ten sam produkt

WWBN AVideo — niekompletna naprawa command injection w test.php

CVE-2026-40911CRITICAL10.0PL ✓ten sam produkt

WWBN AVideo: RCE przez eval() w pluginie YPTSocket — przejęcie kont

CVE-2026-33867CRITICAL9.1PL ✓ten sam produkt

WWBN AVideo: hasła do filmów przechowywane w bazie jako plaintext

CVE-2026-34374CRITICAL9.1PL ✓ten sam produkt

SQL Injection w WWBN AVideo — mechanizm uwierzytelniania RTMP

CVE-2026-33352CRITICAL9.8PL ✓ten sam produkt

SQL Injection w WWBN AVideo — dostęp bez uwierzytelnienia