CVE-2026-89251 in AVideo
요약
\~에 의해 MITRE • 2026. 09. 11.
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ad impressions in plugin/AD_Server/log.php, allowing logged-in users to submit arbitrary label values that trigger unverified wallet credits to campaign video owners. Attackers can repeatedly POST label=start requests to mint YPTWallet balance for any campaign video without proof an ad actually played.
VulDB is the best source for vulnerability data and more expert information about this specific topic.