CVE-2026-40928: WWBN AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset Deletion

Multiple AVideo JSON endpoints under objects/ accept state-changing requests via $_REQUEST/$_GET and persist changes tied to the caller’s session user, without any anti-CSRF token, origin check, or referer check. A malicious page visited by a logged-in victim can silently:

1. Cast/flip the victim’s like/dislike on any comment (objects/comments_like.json.php).
2. Post a comment authored by the victim on any video, with attacker-chosen text (objects/commentAddNew.json.php).
3. Delete assets from any category (objects/categoryDeleteAssets.json.php) when the victim has category management rights.

Each endpoint is reachable from a browser via a simple <img src="…"> tag or form submission, so exploitation only requires the victim to load an attacker-controlled HTML resource.