[CVE-2026-58003] WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the relea…

Descripción técnica

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the releaseVideoNow.json.php endpoint that lacks authenticity checks and accepts GET requests. Attackers can craft a malicious cross-site GET request carrying an administrator's session cookie to permanently publish any embargoed video by manipulating the videos_id parameter.

Puntuación CVSS

Score: 7.1/10 — Severidad: HIGH — Estado NIST: Received

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Debilidades (CWE)

CWE-352

Fuente oficial

Publicado en NIST NVD.