Vulnerabilities ›

CVE-2026-33502

Critical ⚡ Exploit Available

CWE-918 — Weakness Type

                    Published: Mar 23, 2026                      ·  Modified: Mar 29, 2026                      ·  Source: NVD                

CVSS v3

9.3

🔗 NVD Official

📄 Description (English)

WWBN AVideo is an open source video platform. In versions up to and including 26.0, an unauthenticated server-side request forgery vulnerability in `plugin/Live/test.php` allows any remote user to make the AVideo server send HTTP requests to arbitrary URLs. This can be used to probe localhost/internal services and, when reachable, access internal HTTP resources or cloud metadata endpoints. Commit 1e6cf03e93b5a5318204b010ea28440b0d9a5ab3 contains a patch.

🤖 AI Executive Summary

WWBN AVideo versions up to 26.0 contain an unauthenticated server-side request forgery (SSRF) vulnerability in plugin/Live/test.php that allows remote attackers to make the server send HTTP requests to arbitrary URLs. This vulnerability can be exploited to probe internal services, access cloud metadata endpoints, and potentially compromise sensitive internal resources.

📄 Description (Arabic)

ثغرة SSRF في WWBN AVideo تسمح لأي مستخدم بعيد غير مصرح به بإجبار خادم AVideo على إرسال طلبات HTTP إلى عناوين URL تعسفية عبر ملف plugin/Live/test.php. يمكن استخدام هذه الثغرة للوصول إلى الخدمات الداخلية والموارد المحمية وبيانات السحابة الحساسة.

🤖 ملخص تنفيذي (AI)

WWBN AVideo إصدارات حتى 26.0 تحتوي على ثغرة SSRF غير مصرح بها في plugin/Live/test.php تسمح للمهاجمين بإجبار الخادم على إرسال طلبات HTTP إلى عناوين URL عشوائية. يمكن استغلال هذه الثغرة للوصول إلى الخدمات الداخلية ونقاط نهاية بيانات السحابة.

🤖 AI Intelligence Analysis Analyzed: Apr 12, 2026 15:35

🇸🇦 Saudi Arabia Impact Assessment

Saudi Relevance: high

🏢 Affected Saudi Sectors

telecom government healthcare

🎯 MITRE ATT&CK Techniques

T1190 T1498 T1557

⚖️ Saudi Risk Score (AI)

9.0

/ 10.0

🔧 Remediation Steps (English)

Upgrade WWBN AVideo to version 26.1 or later that includes commit 1e6cf03e93b5a5318204b010ea28440b0d9a5ab3. Implement network segmentation to restrict outbound connections from the AVideo server. Apply WAF rules to block requests to internal IP ranges and cloud metadata endpoints. Disable or restrict access to plugin/Live/test.php if not required. Monitor outbound HTTP/HTTPS traffic from the AVideo server for suspicious activity.

🔧 خطوات المعالجة (العربية)

قم بترقية WWBN AVideo إلى الإصدار 26.1 أو أحدث الذي يتضمن الإصلاح. قم بتطبيق تقسيم الشبكة لتقييد الاتصالات الصادرة من خادم AVideo. طبق قواعد جدار الحماية لحظر الطلبات إلى نطاقات IP الداخلية. عطل أو قيد الوصول إلى plugin/Live/test.php إذا لم يكن مطلوباً. راقب حركة HTTP/HTTPS الصادرة من خادم AVideo.

📋 Regulatory Compliance Mapping

🟢 NCA ECC 2024

A.7.1.1 A.7.4.1 A.8.1.1

🔵 SAMA CSF

ID.RA-1 PR.AC-1 PR.PT-1

🟡 ISO 27001:2022

A.6.1.1 A.13.1.1 A.14.2.1

🔗 References & Sources 3

🔗

https://github.com/WWBN/AVideo/commit/1e6cf03e93b5a5318204b010ea28440b0d9a5ab3

security-advisories@github.com

Patch

🔗

https://github.com/WWBN/AVideo/security/advisories/GHSA-3fpm-8rjr-v5mc

security-advisories@github.com

Exploit Mitigation Vendor Advisory

🔗

https://github.com/WWBN/AVideo/security/advisories/GHSA-3fpm-8rjr-v5mc

134c704f-9b21-4f2e-91b3-4a467353bcc0

Exploit Mitigation Vendor Advisory

📦 Affected Products / CPE 1 entries

wwbn:avideo

📊 CVSS Score

9.3

/ 10.0 — Critical

📊 CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Attack VectorN — None / Network

Attack ComplexityL — Low / Local

Privileges RequiredN — None / Network

User InteractionN — None / Network

ScopeC — Changed

ConfidentialityH — High

IntegrityL — Low / Local

AvailabilityN — None / Network

📋 Quick Facts

Severity Critical

CVSS Score9.3

CWECWE-918

Exploit ✓ Yes

Patch ✓ Yes

Published 2026-03-23

Source Feed nvd

🇸🇦 Saudi Risk Score

9.0

/ 10.0 — Saudi Risk

Priority: CRITICAL

🏷️ Tags

exploit-available patch-available CWE-918

🏢 Vendor Advisories

🔗 https://github.com/WWBN/AVideo/security/advisories/G... 🔗 https://github.com/WWBN/AVideo/security/advisories/G...

⚡ Actions

🔗 NVD Official Page ⚡ Exploit-DB Search 🐙 GitHub PoC Search 🎯 MITRE ATT&CK 📊 CVE Details

CVE-2026-33502

Introduce Yourself

Sign In Required