VULNERABILITY INTELLIGENCE

CVE-2026-58001

CVSS score6.9 MEDIUM

EPSS probability0.17%

CISA KEVNot currently listed

Published2026-08-22

Last modified2026-10-12

Description

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in objects/videoEditLight.php that lacks request authenticity checks and accepts GET requests. Attackers can store an img tag in a video description that transfers video ownership to an attacker-controlled account when an administrator views the video page.