CVE-2026-91966 — AVideo through 29.0 Unauthenticated SSRF via Host Header
AVideo through 29.0 contains an unauthenticated server-side request forgery vulnerability in the check_site_availability function that accepts attacker-controlled HTTP Host head…
Published: 2026-09-15 · CVSS: 6.9 · CVSS 4.0
AVideo through 29.0 contains an unauthenticated server-side request forgery vulnerability in the check_site_availability function that accepts attacker-controlled HTTP Host headers. Attackers can send requests to submitIndex.php or ajax.php with arbitrary Host headers to probe internal network hosts and ports, following redirects without authentication.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7