CVE-2026-58003

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions prior to commit 9c39d8c8

Description Cross-site request forgery occurs in the 'releaseVideoNow.json.php' endpoint because it lacks authenticity checks and accepts GET requests. An attacker can craft a malicious cross-site GET request using an administrator's session cookie to permanently publish embargoed videos by manipulating the videos id parameter.

Recommendations Update WWBN AVideo to a version including commit 9c39d8c8 or later.