VULNERABILITY INTELLIGENCE

CVE-2026-83595

CVSS score8.1 HIGH

EPSS probability0.23%

CISA KEVNot currently listed

Published2026-09-01

Last modified2026-09-08

Description

AVideo contains a cross-site request forgery vulnerability in plugin/API/set.json.php that allows attackers to perform state-changing actions by crafting GET requests that bypass CSRF protection. Attackers can navigate a victim's browser to a malicious URL with API parameters to delete videos, deactivate accounts, or modify playlists without user interaction.