{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-33478/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-33478/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-33478/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-33478/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-33478/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-33478/enrichment"},"sightings":{"href":"/api/v1/sightings/cve-2026-33478"},"vulnerability":{"href":"/api/v1/vulnerability/cve-2026-33478"}},"enrichments":{"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-33478.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2026-33478\n\ninfo:\n  name: AVideo <= 26.0 - WWBN AVideo - Remote Code Execution\n  author: pussycat0x\n  severity: critical\n  description: |\n    WWBN AVideo <= 26.0 contains multiple vulnerabilities in the CloneSite plugin including unauthenticated exposure of clone secret keys and OS command injection in rsync command construction, letting unauthenticated attackers achieve remote code execution.\n  impact: |\n    Unauthenticated attackers can execute arbitrary system commands, leading to full server compromise.\n  remediation: |\n    Update to the version including commit c85d076375fab095a14170df7ddb27058134d38c or later.\n  reference:\n    - https://github.com/WWBN/AVideo/security/advisories/GHSA-687q-32c6-8x68\n  metadata:\n    max-request: 1\n    verified: true\n    shodan-query: http.html:\"AVideo\"\n    fofa-query: app=\"AVideo-YouPHPTube\"\n  tags: cve,cve2026,avideo,clonesite,unauth,oss,vkev\n\nhttp:\n  - raw:\n      - |\n        GET /plugin/CloneSite/clones.json.php HTTP/1.1\n        Host: {{Hostname}}\n        Accept: application/json\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '{\"data\": ['\n          - '\"key\":\"'\n        condition: and\n\n      - type: word\n        part: content_type\n        words:\n          - \"application/json\"\n\n      - type: word\n        part: body\n        words:\n          - '\"error\"'\n          - \"Admin required\"\n        negative: true\n        condition: or\n\n      - type: status\n        status:\n          - 200\n\n    extractors:\n      - type: regex\n        name: key\n        group: 1\n        part: body\n        regex:\n          - '\"key\":\"([0-9a-z]+)\"'\n# digest: 4a0a0047304502205a81085a2319ec651de3bebae07fc8ec5d0632d7d32ad22dad3ef064d0ae1b71022100e0e1bee92f2bfc805b4ba7a2df4907333b87d8a1b8e9ad5f0af093a511875455:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2026-33478"}