Skip to contentWwbn vulnerabilities
Newest
- wwbn avideoAVideo Vulnerable to OS Command Injection via Unsanitized `users_id` and `liveTransmitionHistory_id` in Restreamer Log File PathCVE-2026-336488.8 High
- wwbn avideoAVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File UploadCVE-2026-336478.8 High
- wwbn avideoAVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP)CVE-2026-335138.6 High
- wwbn avideoAVideo has an unauthenticated decrypt oracle leaking any ciphertextCVE-2026-335127.5 High
- wwbn avideoAVideo Affected by CSRF on Plugin Import Endpoint Enables Unauthenticated Remote Code Execution via Malicious Plugin UploadCVE-2026-335078.8 High
- wwbn avideoAVideo has Unauthenticated SSRF via plugin/Live/test.phpCVE-2026-335029.3 Critical
- wwbn avideoAVideo has Unauthenticated Information Disclosure of User Group Permission Mappings via Permissions PluginCVE-2026-335015.3 Medium
- wwbn avideoAVideo Vulnerable to Stored XSS via Markdown `javascript:` URI Bypasses ParsedownSafeWithLinks SanitizationCVE-2026-335005.4 Medium
- wwbn avideoAVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.phpCVE-2026-334996.1 Medium
- wwbn avideoAVideo has a Path Traversal in import.json.php that Allows Private Video Theft and Arbitrary File Read/Deletion via fileURI ParameterCVE-2026-334937.1 High
- wwbn avideoAVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session RegenerationCVE-2026-334927.3 High
- wwbn avideoAVideo has a PGP 2FA Bypass via Cryptographically Broken 512-bit RSA Key Generation in LoginControl PluginCVE-2026-334887.4 High
- wwbn avideoAVideo has an Unauthenticated Blind SQL Injection in RTMP on_publish Callback via Stream Name ParameterCVE-2026-334857.5 High
- wwbn avideoAVideo Affected by Unauthenticated Disk Space Exhaustion via Unlimited Temp File Creation in aVideoEncoderChunk.json.phpCVE-2026-334837.5 High
- wwbn avideoAVideo has an OS Command Injection via $() Shell Substitution Bypass in sanitizeFFmpegCommand()CVE-2026-334828.1 High
- wwbn avideoAVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks ProxyCVE-2026-334808.6 High
- wwbn avideoAVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against AdminCVE-2026-334798.8 High
- wwbn avideoAVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command InjectionCVE-2026-33478EPSS 13.5%10.0 Critical
- wwbn avideoWWBN AVideo has predictable default admin credentials in official Docker deployment pathCVE-2026-330378.1 High
- wwbn avideo-encoderAVideo-Encoder is Vulnerable to Authenticated SQL Injection via ORDER BY ClauseCVE-2026-330258.6 High
- wwbn avideo-encoderAVideo-Encoder has Unauthenticated Blind Server-Side Request Forgery via Public Thumbnail GeneratorCVE-2026-330249.3 Critical
- wwbn avideoAVideo has an authenticated arbitrary local file read via `chunkFile` path injection in `aVideoEncoder.json.php`CVE-2026-333547.6 High
- wwbn avideoAVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass)CVE-2026-333529.8 Critical
- wwbn avideoAVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification BypassCVE-2026-333519.1 Critical
- wwbn avideoAVideo has an IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.phpCVE-2026-332975.1 Medium
- wwbn avideoAVideo has an Open Redirect via Unvalidated redirectUri in userLogin.phpCVE-2026-332962.1 Low
- wwbn avideoAVideo Vulnerable to Stored XSS via Unescaped Video Title in CDN downloadButtons.phpCVE-2026-332958.2 High
- wwbn avideoAVideo has SSRF in BulkEmbed Thumbnail Fetch that Allows Reading Internal Network ResourcesCVE-2026-332945.0 Medium
- wwbn avideoAVideo Affected by Arbitrary File Deletion via Path Traversal in CloneSite deleteDump ParameterCVE-2026-332938.1 High
- wwbn avideoAVideo has Authorization Bypass via Path Traversal in HLS Endpoint Allows Streaming Private/Paid VideosCVE-2026-332927.5 High
- avideoAVideo - Unauthenticated PGP Message Decryption via decryptMessage.json.php EndpointCVE-2026-563466.9 Medium
- wwbn avideoAVideo Vulnerable to OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell CommandCVE-2026-333195.9 Medium
- wwbn avideoAVideo has a Path Traversal in listFiles.json.php that Enables Server Filesystem EnumerationCVE-2026-33238Fix available4.3 Medium
- wwbn avideoAVideo has SSRF in Scheduler Plugin via callbackURL Missing `isSSRFSafeURL()` ValidationCVE-2026-33237Fix available5.5 Medium
- wwbn avideoAVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxyCVE-2026-330398.6 High
- wwbn avideoUnauthenticated Reflected XSS via innerHTML in AVideoCVE-2026-330355.3 Medium
- wwbn avideoAVideo affected by Session Hijacking via Unauthenticated Session ID Disclosure with Permissive CORSCVE-2026-330438.1 High
- wwbn avideoAVideo has an Unauthenticated Password Hash Oracle via encryptPass.json.phpCVE-2026-330415.3 Medium
- wwbn avideoAVideo affected by unauthenticated application takeover via exposed web installer on uninitialized deploymentsCVE-2026-330388.1 High
- wwbn avideoWWBN AVideo - Unauthenticated IDOR - Playlist Information DisclosureCVE-2026-30885Fix available5.5 Medium
- wwbn avideoWWBN AVideo: Unauthenticated PHP session store exposed to host network via published memcached portCVE-2026-290938.1 High
- wwbn avideo-encoderAVideo: Unauthenticated OS Command Injection via base64Url in objects/getImage.phpCVE-2026-29058Public exploitFix available9.8 Critical
- wwbn avideoWWBN AVideo: Authenticated Remote Code Execution via Unsafe Plugin ZIP ExtractionCVE-2026-28502Fix available9.3 Critical
- wwbn avideoWWBN AVideo: Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.phpCVE-2026-285019.8 Critical
- wwbn avideoAVideo has Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.phpCVE-2026-27732Fix available8.6 High
- wwbn avideoAVideo has Stored Cross-Site Scripting via Markdown Comment InjectionCVE-2026-27568Fix available5.1 Medium
- avideo platform, wwbn avideo +1 moreAVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)CVE-2020-371588.5 High
- avideo platform, wwbn avideo +1 moreAVideo Platform 8.1 - Information Disclosure (User Enumeration)CVE-2020-371738.7 High
- avideo platform, wwbn avideo +1 moreAVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)CVE-2020-371728.5 High
- world wide broadcast network avideoAVideo < 20.1 Unauthenticated RCE via Predictable Installation SaltCVE-2025-34433Public exploit9.3 Critical
- Show moreLoading…