Zero Day MonitorZDM
DashboardVulnerabilitiesTrendingZero-DaysNews
Login
ImpressumPrivacy Policy
Zero Day Monitor © 2026
2758 articles · 106400 vulns · 38/41 feeds (7d)
← Back to list
6.5
CVE-2026-34613EXPLOITED
wwbn · avideo

AVideo: CSRF on Plugin Enable/Disable Endpoint Allows Disabling Security Plugins

Description

A vulnerability was found in WWBN AVideo up to 26.0. It has been classified as problematic. This vulnerability affects the function ignoreTableSecurityCheck of the file objects/pluginSwitch.json.php of the component Endpoint. Performing a manipulation results in cross-site request forgery. This vulnerability is known as CVE-2026-34613. Remote exploitation of the attack is possible.

Affected Products

VendorProductVersions
wwbnavideo<= 26.0

References

  • https://github.com/WWBN/AVideo/security/advisories/GHSA-hqxf-mhfw-rc44(x_refsource_CONFIRM)

Related News (1 articles)

Tier C
VulDB5h ago
CVE-2026-34613 | WWBN AVideo up to 26.0 Endpoint pluginSwitch.json.php ignoreTableSecurityCheck cross-site request forgery (GHSA-hqxf-mhfw-rc44)
→ No new info (linked only)
CVSS 3.16.5 HIGH
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CISA KEV❌ No
Actively exploited✅ Yes
CWECWE-352
PublishedMar 31, 2026
Last enriched5h agov2
Trending Score46
Source articles1
Independent1
Info Completeness8/14
Missing: epss, kev, exploit, patch, iocs, mitre_attack

Community Vote

0
Login to vote
0 upvotes0 downvotes
No votes yet

Related CVEs (5)

CRITICALCVE-2026-34740EXP
AVideo: Stored SSRF via Video EPG Link Missing isSSRFSafeURL() Validation
Trending: 49
CRITICALCVE-2026-34738EXP
AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter
Trending: 49
CRITICALCVE-2026-34732EXP
AVideo: Missing Authentication in CreatePlugin list.json.php Template Affects 21 Endpoints
Trending: 49
CRITICALCVE-2026-34733EXP
AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard
Trending: 49
HIGHCVE-2026-34716EXP
AVideo: DOM XSS via Unsanitized Display Name in WebSocket Call Notification
Trending: 46

Pin to Dashboard

Verification

State: unverified
Confidence: 0%

Vulnerability Timeline

CVE Published
Mar 31, 2026
Actively Exploited
Mar 31, 2026
Discovered by ZDM
Mar 31, 2026
Updated: description, severity, activelyExploited
Apr 1, 2026

Version History

v2
Last enriched 5h ago
v2Tier C5h ago

Updated description with more technical detail, changed severity to HIGH, and marked the vulnerability as actively exploited.

descriptionseverityactivelyExploited
via VulDB
v110h ago

Initial creation