https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-14T15:22:26.705371+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-33038 CVE-2026-33038 — AVideo affected by unauthenticated application takeover via exposed web installer on uninitialized deployments 2026-10-14T15:22:26.726140+00:00

Affected: WWBN AVideo

WWBN AVideo is an open source video platform. Versions 25.0 and below are vulnerable to unauthenticated application takeover through the install/checkConfiguration.php endpoint. install/checkConfiguration.php performs full application initialization: database setup, admin account creation, and configuration file write, all from an unauthenticated POST input. The only guard is checking whether videos/configuration.php already exists. On uninitialized deployments, any remote attacker can complete the installation with attacker-controlled credentials and an attacker-controlled database, gaining full administrative access. This issue has been fixed in version 26.0.