Home / Vulnerability Intelligence / CVE-2026-33351

CVE-2026-33351 - Vulnerability Analysis

CriticalCVSS: 9.1

Last Updated: March 23, 2026

WWBN AVideo - Server-Side Request Forgery

Published: March 23, 2026Updated: March 23, 2026PoC AvailableRemote Exploitable

Overview

WWBN AVideo < 26.0 contains a server-side request forgery caused by unsanitized use of the 'webSiteRootURL' parameter in plugin/Live/standAloneFiles/saveDVR.json.php, letting remote attackers make arbitrary server-side requests, exploit requires the AVideo Live plugin in standalone mode.

Severity & Score

Severity: Critical

CVSS Score: 9.1

EPSS Score: 0.0%(Probability of exploitation in next 30 days)

Impact

Remote attackers can make arbitrary server-side requests, potentially accessing internal resources or causing denial of service.

Mitigation

Update to version 26.0 or later.

References

Social Media Activity(2 posts)

TheHackerWire

@thehackerwire

Mar 23, 2026

🔴 CVE-2026-33351 - Critical (9.1) WWBN AVideo is an open source video platform. Prior to version 26.0, a Server-Side Request Forgery (SSRF) vulnerability exists in `plugin/Live/standAloneFiles/saveDVR.json.php`. When the AVideo Live plugin is deployed in standalone mode (the inten... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33351/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

TheHackerWire

@thehackerwire

Mar 23, 2026

View original post

Related Resources

Details

CVE ID: CVE-2026-33351
Severity: Critical
CVSS Score: 9.1
Type: server_side_request_forgery
Status: confirmed
EPSS: 0.0%
Social Posts: 2

CWE

CWE-918

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS Score

0.0%Probability of exploitation in the next 30 days