Homepage

Cross-site Request Forgery (CSRF) The advisory has been revoked - it doesn't affect any version of package wwbn/avideo  (opens in a new tab)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-PHP-WWBNAVIDEO-16069576
  • published15 Apr 2026
  • disclosed14 Apr 2026
  • creditoffset
Report a new vulnerability Found a mistake?

Introduced: 14 Apr 2026

CVE NOT AVAILABLE CWE-352  (opens in a new tab)

How to fix?

A fix was pushed into the master branch but not yet published.

Amendment

This was deemed not a vulnerability.

Overview

wwbn/avideo is an Audio and Video Platform or simply "A Video Platform".

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) through the commentDelete.json.php endpoint, which lacks proper validation of request origin and does not require a CSRF token. An attacker can cause mass deletion of comments by tricking an authenticated user with sufficient privileges (such as a moderator or video owner) into visiting a malicious page that issues crafted requests to the vulnerable endpoint.