CVE-2026-33294

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

WWBN AVideo is an open source video platform. Prior to version 26.0, the BulkEmbed plugin's save endpoint (`plugin/BulkEmbed/save.json.php`) fetches user-supplied thumbnail URLs via `url_get_contents()` without SSRF protection. Unlike all six other URL-fetching endpoints in AVideo that were hardened with `isSSRFSafeURL()`, this code path was missed. An authenticated attacker can force the server to make HTTP requests to internal network resources and retrieve the responses by viewing the saved video thumbnail. Version 26.0 fixes the issue.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published
Mar 22, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-332955.4WWBN AVideo is an open source video platform. Prior to version 26.0, WWBN/AVideo contains a stored cross-site scripting vulnerability in theCVE-2026-332966.1WWBN AVideo is an open source video platform. Prior to version 26.0, WWBN/AVideo contains an open redirect vulnerability in the login flow wCVE-2026-332979.1WWBN AVideo is an open source video platform. Prior to version 26.0, the `setPassword.json.php` endpoint in the CustomizeUser plugin allows CVE-2026-332987.8llama.cpp is an inference of several LLM models in C/C++. Prior to b7824, an integer overflow vulnerability in the `ggml_nbytes` function alCVE-2026-332995.4OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, users with the `NCVE-2026-33304.9The Form Maker by 10Web plugin for WordPress is vulnerable to SQL Injection via the 'ip_search', 'startdate', 'enddate', 'username_search', CVE-2026-333006.5Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2CVE-2026-333018.1OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, users with the `CVE-2026-333028.1OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, the module ACL fuCVE-2026-333035.4OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.2 are vulneCVE-2026-333046.5OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, an authorization CVE-2026-333055.4OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, an authorization