CVE-2026-114048— WWBN AVideo before 24.0 CSRF via Legacy Playlist and Video Endpoints
Quick assessment
Affected
WWBN AVideo
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WWBN AVideo 24.0 之前的版本在诸如 playlistStatus.php 等遗留端点中存在跨站请求伪造（CSRF）漏洞。该漏洞绕过了仅适用于 .json.php 文件的 autoCSRFGuard() 自动 CSRF 防护机制。攻击者可诱使已登录用户访问包含自动提交表单的页面，从而将私有播放列表公开、删除播放列表中的视频，或伪造视频推荐。
Possible ATT&CK Techniques 1 AI
T1566.003 · Spearphishing via Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-114048
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WWBN AVideo before 24.0 CSRF via Legacy Playlist and Video Endpoints
Source: CVE Program / CVE List V5
Vulnerability Description
WWBN AVideo before 24.0 contains a cross-site request forgery vulnerability in legacy endpoints like playlistStatus.php that bypass the .json.php-only autoCSRFGuard() check. Attackers can lure logged-in users to a page with an auto-submitting form to make private playlists public, remove playlist videos, or forge video suggestions.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
跨站请求伪造(CSRF)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-114048
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-114048
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-114048 (2)
IV. Related Vulnerabilities
Same product: AVideo
-
CVE-2026-105086
WWBN AVideo 12.4 through 29.2.0 Stored XSS via Double-Encode -
CVE-2026-105089
WWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHP -
CVE-2026-100630
AVideo before 29.1.0 Stored XSS via HTML Entity Bypass in tr -
CVE-2026-92915
WWBN AVideo userVerifyEmail.php Unauthenticated Access Contr -
CVE-2026-92914
AVideo LoginControl PGP Second Factor Authentication Bypass
Same vendor: WWBN
-
CVE-2026-105086
WWBN AVideo 12.4 through 29.2.0 Stored XSS via Double-Encode -
CVE-2026-105089
WWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHP -
CVE-2026-100630
AVideo before 29.1.0 Stored XSS via HTML Entity Bypass in tr -
CVE-2026-92915
WWBN AVideo userVerifyEmail.php Unauthenticated Access Contr -
CVE-2026-92914
AVideo LoginControl PGP Second Factor Authentication Bypass
Same weakness: CWE-352
-
CVE-2026-114093
Trigger.dev before 4.5.6 Cross-Site Request Forgery via /log -
CVE-2026-114089
Trigger.dev before 4.5.2 CLI Auth-Code Phishing Leading to P -
CVE-2026-114072
Trigger.dev before 4.5.12 CSRF via Slack OAuth Callback Stat -
CVE-2026-112836
WordPress VikRentCar plugin <= 1.4.8 - Cross Site Request Fo -
CVE-2026-86467
Apache Airflow Amazon provider: AWS auth manager: SAML login
V. Comments for CVE-2026-114048
No comments yet