CyberRota Analysis
AI-GeneratedThe LoginControl plugin in WWBN AVideo is vulnerable to a cross-site request forgery (CSRF) due to the absence of CSRF token validation in its PGP key endpoints. This flaw allows attackers to create malicious pages that can manipulate a logged-in user's PGP 2FA public key, potentially leading to account lockout or takeover if the attacker has the victim's password. Organizations using this plugin should prioritize patching this vulnerability to protect against unauthorized access and account compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in the LoginControl plugin PGP key endpoints that lack CSRF token validation. Attackers can craft malicious pages with image tags pointing to savePublicKey.json.php to replace a logged-in victim's PGP 2FA public key, causing lockout or enabling account takeover if the attacker knows the password.