Vulnerability · Published Aug 22, 2026 · Assigned by VulnCheck
CVE-2026-58001WWBN AVideo Cross-Site Request Forgery via videoEditLight.php
Medium 5.7
In plain English
A medium-severity cross-site request forgery in AVideo from WWBN. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).
Severity (CVSS 3.1)5.7Medium
Exploit odds (30 days)0.2%top 94.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in objects/videoEditLight.php that lacks request authenticity checks and accepts GET requests. Attackers can store an img tag in a video description that transfers video ownership to an attacker-controlled account when an administrator views the video page.
Affected products (as reported)
Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
References
- GitHub Security Advisory (GHSA-7mqw-mqc3-ffjw) vendor-advisory
- VulnCheck Advisory: WWBN AVideo Cross-Site Request Forgery via videoEditLight.php third-party-advisory