CVE-2026-58001
MEDIUM
NVD
CVSS Score
5.7
Severity
MEDIUM
Published
Aug 22, 2026
Vendor
unknown
Description
WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in objects/videoEditLight.php that lacks request authenticity checks and accepts GET requests. Attackers can store an img tag in a video description that transfers video ownership to an attacker-controlled account when an administrator views the video page.