CVE-2026-83595 — AVideo Cross-Site Request Forgery via plugin/API/set.json.php
AVideo contains a cross-site request forgery vulnerability in plugin/API/set.json.php that allows attackers to perform state-changing actions by crafting GET requests that bypas…
Published: 2026-09-01 · CVSS: 7.2 · CVSS 4.0
AVideo contains a cross-site request forgery vulnerability in plugin/API/set.json.php that allows attackers to perform state-changing actions by crafting GET requests that bypass CSRF protection. Attackers can navigate a victim's browser to a malicious URL with API parameters to delete videos, deactivate accounts, or modify playlists without user interaction.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7