Medium severity6.1NVD Advisory· Published Aug 30, 2026· Updated Aug 31, 2026
CVE-2026-82647
CVE-2026-82647
Description
WWBN AVideo contains a cross-site request forgery vulnerability in sendEmail.json.php that allows authenticated administrators to send mail from the site's contact address by bypassing origin checks and captcha validation. Attackers can craft a malicious web page that, when visited by an authenticated admin, sends emails with attacker-controlled subject and body to arbitrary recipients, passing SPF/DKIM/DMARC validation for phishing and brand impersonation attacks.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
2News mentions
2- WWBN AVideo: 16 Vulnerabilities Disclosed, Including Critical Auth and Password Reset FlawsVypr Intelligence · Sep 1, 2026
- WWBN AVideo: Six Vulnerabilities Including SSRF Bypass and Credential Exposure Disclosed TogetherVypr Intelligence · Aug 30, 2026