[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"cve-CVE-2026-33685":3},{"id":4,"cve_id":5,"euvd_id":6,"summary":7,"published":8,"cvss_data":9,"is_remote":19,"cwes":20,"cpes":22,"technologies":25,"references":27,"score":32,"epss_score":33,"epss_percentile":34,"is_kev":35,"cisa_kev_date_added":36,"cisa_kev_due_date":36,"cisa_ssvc":37,"attack_mappings":47,"exploits":78},6956,"CVE-2026-33685","EUVD-2026-14496","WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `plugin\u002FAD_Server\u002Freports.json.php` endpoint performs no authentication or authorization checks, allowing any unauthenticated attacker to extract ad campaign analytics data including video titles, user channel names, user IDs, ad campaign names, and impression\u002Fclick counts. The HTML counterpart (`reports.php`) and CSV export (`getCSV.php`) both correctly enforce `User::isAdmin()`, but the JSON API was left unprotected. Commit daca4ffb1ce19643eecaa044362c41ac2ce45dde contains a patch.","2026-03-23T19:16:00Z",{"cvss_v3.1":10},{"scope":11,"version":12,"baseScore":13,"attackVector":14,"baseSeverity":15,"vectorString":16,"integrityImpact":17,"userInteraction":17,"attackComplexity":18,"availabilityImpact":17,"privilegesRequired":17,"confidentialityImpact":18},"UNCHANGED","3.1",5.3,"NETWORK","MEDIUM","CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N","NONE","LOW",true,[21],"CWE-862",[23,24],"cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*","cpe:2.3:a:wwbn:avideo:26.0:*:*:*:*:*:*:*",[26],"Wwbn Avideo",[28,29,30,31],"https:\u002F\u002Fgithub.com\u002FWWBN\u002FAVideo\u002Fcommit\u002Fdaca4ffb1ce19643eecaa044362c41ac2ce45dde","https:\u002F\u002Fgithub.com\u002FWWBN\u002FAVideo\u002Fsecurity\u002Fadvisories\u002FGHSA-j36m-74g2-7m95","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-33685","https:\u002F\u002Fgithub.com\u002FWWBN\u002FAVideo",0.62,0.00321,0.24846,false,null,{"timestamp":38,"automatable":39,"tech_impact":40,"exploitation":41,"cisa_decision":42,"cisa_remediation_timeline":46},"2026-03-24T14:44:14.212528Z","yes","partial","poc",{"vector":43,"decision":44,"priority":45},"CISAv1\u002FE:P\u002FA:Y\u002FT:P\u002FM:H\u002F2026-10-25T20:02:51.178949\u002F","attend","medium","14D",[48,54,63,70],{"name":49,"source":50,"tactics":51,"technique_id":53},"Exploit Public-Facing Application","attack_vector",[52],"initial-access","T1190",{"name":55,"source":56,"cwe_ids":57,"tactics":58,"capec_ids":60,"technique_id":62},"Exploitation for Stealth","capec",[21],[59],"stealth",[61],"CAPEC-665","T1211",{"name":64,"source":56,"cwe_ids":65,"tactics":66,"capec_ids":68,"technique_id":69},"Component Firmware",[21],[67,59],"persistence",[61],"T1542.002",{"name":71,"source":56,"cwe_ids":72,"tactics":73,"capec_ids":76,"technique_id":77},"Modify Authentication Process",[21],[74,75,67],"credential-access","defense-impairment",[61],"T1556",[79],{"link":29}]