Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the Gallery plugin's `saveSort.json.php` endpoint passes unsanitized user input from `$_REQUEST['sections']` array values directly into PHP's `eval()` function. While the endpoint is gated behind `User::isAdmin()`, it has no CSRF token validation. Combined with AVideo's explicit `SameSite=None` session cookie configuration, an attacker can exploit this via cross-site request forgery to achieve unauthenticated remote code execution — requiring only that an admin visits an attacker-controlled page. Commit 087dab8841f8bdb54be184105ef19b47c5698fcb contains a patch.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-33479 Remote Code Execution in WWBN AVideo Gallery Plugin via CSRF and Eval Injection https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-33479
Post summary
The post announces CVE‑2026‑33479, highlighting a Remote Code Execution flaw in the WWBN AVideo Gallery Plugin that exploits CSRF and Eval injection, but it provides no PoC, exploit code, or evidence of active exploitation.
[CVE-2026-33479: HIGH] Warning: Cybersecurity risk in AVideo! Update to version 26.0 to patch remote code execution vulnerability. Admins are advised to apply commit 087dab8841f8bdb54be184105ef19b47c5698fcb.#cve,CVE-2026-33479,#cybersecurity https://cvefind.com/CVE-2026-33479
Post summary
The announcement notes a high‑severity remote code‑execution vulnerability (CVE‑2026‑33479) in AVideo and advises admins to update to version 26.0, applying a specific commit to patch the issue.
🟠 CVE-2026-33479 - High WWBN AVideo is an open source video platform. In versions up to and including 26.0, the Gallery plugin's `saveSort.json.php` endpoint passes unsanitized user input from `$_REQUEST['sections']... https://www.thehackerwire.com/vulnerability/CVE-2026-33479/ https://t.co/dRiMy96WVL
Post summary
The tweet announces CVE‑2026‑33479, noting that WWBN AVideo’s Gallery plugin allows unsanitized user input via its `saveSort.json.php` endpoint.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | wwbn | avideo | - | - | - |