Most recent entries from all https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 13:58:25 +0000 CVE-2026-92585 — AVideo through 29.0 Missing Authorization Check via API Like Endpoint https://vulnerability.circl.lu/vuln/cve-2026-92585 <p><strong>Affected:</strong> WWBN AVideo</p> <p>AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to validate video access permissions in the API like endpoint, allowing logged-in users to vote on password-protected and group-restricted videos. Attackers can submit like and dislike requests to increment vote counters on videos they cannot watch by calling the set.json.php endpoint with APIName parameters.</p> <p><strong>Affected:</strong> WWBN AVideo</p> <p>AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to validate video access permissions in the API like endpoint, allowing logged-in users to vote on password-protected and group-restricted videos. Attackers can submit like and dislike requests to increment vote counters on videos they cannot watch by calling the set.json.php endpoint with APIName parameters.</p> https://vulnerability.circl.lu/vuln/cve-2026-92585