CVE-2026-33351

WWBN AVideo is an open source video platform. Prior to version 26.0, a Server-Side Request Forgery (SSRF) vulnerability exists in `plugin/Live/standAloneFiles/saveDVR.json.php`. When the AVideo Live plugin is deployed in standalone mode (the intended configuration for this file), the `$_REQUEST['webSiteRootURL']` parameter is used directly to construct a URL that is fetched server-side via `file_get_contents()`. No authentication, origin validation, or URL allowlisting is performed. Version 26.0 contains a patch for the issue.

• CWE-918

• https://github.com/WWBN/AVideo/commit/d0c54960389eeb85e76caed5a257ae90e6a739f2Patch
• https://github.com/WWBN/AVideo/security/advisories/GHSA-5f7v-4f6g-74rjExploit, Mitigation, Vendor Advisory

Published

Mar 23, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33346OpenEMR is a free and open source electronic health records …8.7
• CVE-2026-33347league/commonmark is a PHP Markdown parser. From version 2.3…6.1
• CVE-2026-33348OpenEMR is a free and open source electronic health records …5.4
• CVE-2026-33349fast-xml-parser allows users to process XML from JS object w…5.9
• CVE-2026-3335The Canto plugin for WordPress is vulnerable to Missing Auth…5.3
• CVE-2026-33350LORIS (Longitudinal Online Research and Imaging System) is a…7.5
• CVE-2026-33352WWBN AVideo is an open source video platform. Prior to versi…9.8
• CVE-2026-33353Soft Serve is a self-hostable Git server for the command lin…6.5
• CVE-2026-33354WWBN AVideo is an open source video platform. In versions up…6.5
• CVE-2026-33355Discourse is an open-source discussion platform. Prior to ve…6.5
• CVE-2026-33356In Meari IoT Cloud MQTT Broker deployments running EMQX 4.x,…7.7
• CVE-2026-33357In Meari client applications embedding "com.meari.sdk" (incl…7.5