VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Sep 11, 2026· Updated Sep 11, 2026

CVE-2026-89251

CVE-2026-89251

Description

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ad impressions in plugin/AD_Server/log.php, allowing logged-in users to submit arbitrary label values that trigger unverified wallet credits to campaign video owners. Attackers can repeatedly POST label=start requests to mint YPTWallet balance for any campaign video without proof an ad actually played.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • WWBN/Avideoinferred2 versions
    (expand)+ 1 more
    • (no CPE)
    • (no CPE)range: up to commit c3edcc274c389816d434acadac07ee78eaf330c1
  • AVideo/AVideollm-fuzzy
    Range: up to commit c3edcc274c389816d434acadac07ee78eaf330c1

Patches

Vulnerability mechanics

References

2

News mentions

1