CyberRota Analysis
AI-GeneratedThe vulnerability allows authenticated users to create reminders for private live schedules they do not have permission to view, potentially exposing sensitive schedule titles through generated email notifications. This flaw primarily affects users of the WWBN AVideo platform who have access to the reminder feature. Organizations utilizing this software should prioritize addressing this issue to prevent unauthorized information disclosure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate that logged-in users can access live schedules before creating reminders via remindMe.json.php. Authenticated attackers can create scheduler reminders for private live schedules they cannot view and learn the private schedule title from the generated email job.