medium · CVSS v3 4.3 · CVSS v4 5.3

CVE-2026-114634

WWBN AVideo before 29.4.0 contains a blind server-side request forgery vulnerability in getHeaderContentTypeFromURL() be…

Description

WWBN AVideo before 29.4.0 contains a blind server-side request forgery vulnerability in getHeaderContentTypeFromURL() because get_headers() follows redirects without re-validating targets with isSSRFSafeURL(). Authenticated uploaders can store a videoLink pointing to a redirector, causing internal GET requests when visitors view the video, enabling internal port scanning via the embed-versus-video render oracle.

Scores

Severity
medium
CVSS v2
4
CVSS v3
4.3
CVSS v4
5.3
EPSS
—

← All CVEs

Related CVEs

medium

CVE-2026-87937

Drupal Central Authentication System (CAS) Server has an open redirect vulnerability that allows attackers to redirect users to malicious sites. The flaw exists in versions 0.0.0 through 2.0.4 and 2.1.0 through 2.1.3. It can be exploited without authentication, potentially compromising user trust and session integrity.

View analysis

medium

CVE-2026-84919

Drupal PhotoSwipe plugin has a stored XSS flaw that can be triggered by malicious input in image captions or metadata. Attackers can inject scripts that execute in the browser of any user viewing the gallery, potentially leading to session hijacking or defacement.

View analysis

medium

CVE-2026-84924

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Reflected XSS. This issue affects Email Verification / SMS Verification / OTP Verification versions: from 0.0.0 to 2.4.0.

View analysis

medium

CVE-2026-84915

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Component blocks allows Stored XSS. This issue affects Component blocks versions: from 0.0.0 to 1.2.7.

View analysis