CVE-2026-33685 | BDVDB-2026-322111 Detail

Description#

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `plugin/AD_Server/reports.json.php` endpoint performs no authentication or authorization checks, allowing any unauthenticated attacker to extract ad campaign analytics data including video titles, user channel names, user IDs, ad campaign names, and impression/click counts. The HTML counterpart (`reports.php`) and CSV export (`getCSV.php`) both correctly enforce `User::isAdmin()`, but the JSON API was left unprotected. Commit daca4ffb1ce19643eecaa044362c41ac2ce45dde contains a patch.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-03-23Record published in the CVE List.
2. Version 22026-03-24Most recent update recorded in the CVE List.