CVE-2026-82647

Name of the Vulnerable Software and Affected Versions WWBN AVideo (affected versions not specified)

Description An issue exists in the 'sendEmail.json.php' endpoint that allows authenticated administrators to send emails from the site contact address by bypassing origin checks and captcha validation. This occurs via Cross-Site Request Forgery (CSRF), a technique where a malicious website tricks a user's browser into performing an unwanted action on a different website where the user is authenticated. Attackers can create a malicious page that, when visited by an admin, sends emails with custom subjects and bodies to any recipient. Because the emails originate from the legitimate server, they pass SPF, DKIM, and DMARC validation, facilitating phishing and brand impersonation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.