CVE-2026-33502 - Vulnerability Analysis
CriticalCVSS: 9.3Last Updated: March 23, 2026
WWBN AVideo - Server-Side Request Forgery
Published: March 23, 2026Updated: March 23, 2026Remote Exploitable
Overview
WWBN AVideo <= 26.0 contains a server-side request forgery caused by unauthenticated access in plugin/Live/test.php, letting remote attackers make the server send HTTP requests to arbitrary URLs, exploit requires no authentication.
Severity & Score
Severity: Critical
CVSS Score: 9.3
Impact
Remote attackers can make the server send requests to internal or arbitrary URLs, potentially accessing sensitive internal resources.
Mitigation
Update to a version including commit 1e6cf03e93b5a5318204b010ea28440b0d9a5ab3 or later.
References
Related Resources
Details
- CVE ID
- CVE-2026-33502
- Severity
- Critical
- CVSS Score
- 9.3
- Type
- server_side_request_forgery
- Status
- new
CWE
- CWE-918
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N