Security Advisory

CVE-2026-85161

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-09-03 11:22:13

Last updated 2026-09-03 14:30:23

Assigner VulnCheck

CVSS score 5.3

State PUBLISHED

Description

AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in removePoster.php that lacks forbidIfNotPost or forbidIfInvalidToken checks. Attackers can craft malicious image tags to delete authenticated victims' live poster and thumbnail files via GET requests.

← Browse all CVEs View on cve.org ↗