CVE-2026-88872 in AVideo
सारांश
द्वारा VulDB • 10/09/2026
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in the setPassword.json.php endpoint that allows unauthenticated attackers to modify any user's channel password by sending a GET request. Attackers can craft a malicious webpage that, when visited by an authenticated administrator, sets or clears any user's channel password without CSRF token validation.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.