CVE-2026-33507HIGH 8.8EPSS p28.4%

CVE-2026-33507CVE-2026-33507

Description

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/pluginImport.json.php` endpoint allows admin users to upload and install plugin ZIP files containing executable PHP code, but lacks any CSRF protection. Combined with the application explicitly setting `session.cookie_samesite = 'None'` for HTTPS connections, an unauthenticated attacker can craft a page that, when visited by an authenticated admin, silently uploads a malicious plugin containing a PHP webshell, achieving Remote Code Execution on the server. Commit d1bc1695edd9ad4468a48cea0df6cd943a2635f3 contains a patch.

Scoring

CVSS 3.18.8 (HIGH)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS0.37% probability of exploitation · percentile 28.4% · 2026-06-18T12:00:27Z
Published2026-03-23
Last modified2026-03-24

Underlying weaknesses· 1

CWE-352

References

  1. https://github.com/WWBN/AVideo/commit/d1bc1695edd9ad4468a48cea0df6cd943a2635f3
  2. https://github.com/WWBN/AVideo/security/advisories/GHSA-hv36-p4w4-6vmj
  3. https://github.com/WWBN/AVideo/security/advisories/GHSA-hv36-p4w4-6vmj

1

TypeTargetConfidenceTier
WeaknessCross-Site Request Forgery (CSRF)cwe-3520%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2026-28502
CVE
CVE-2026-33649
CVE
CVE-2026-34394
CVE
CVE-2026-33479
CVE
CVE-2026-33493
CVE
CVE-2026-33502
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.