Skip to contentWwbn vulnerabilities
Newest
- wwbn avideoWWBN AVideo affected by CSRF on Site Customization Endpoint Enables Logo Overwrite via Base64 File WriteCVE-2026-351804.3 Medium
- wwbn avideoWWBN AVideo has Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.phpCVE-2026-354525.3 Medium
- wwbn avideoWWBN AVideo has Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.phpCVE-2026-354505.3 Medium
- wwbn avideoWWBN AVideo has Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.phpCVE-2026-354495.3 Medium
- wwbn avideoWWBN AVideo Provides Unauthenticated Access to Payment Order Data via BlockonomicsYPT check.phpCVE-2026-354483.7 Low
- wwbn avideoWWBN AVideo Affected by CSRF on Player Skin Configuration via admin/playerUpdate.json.phpCVE-2026-351814.3 Medium
- wwbn avideoWWBN AVideo Unauthenticated Instagram Graph API Proxy via publishInstagram.json.phpCVE-2026-351795.3 Medium
- wwbn avideoAVideo TopMenu Plugin - Stored Cross-Site Scripting via Unescaped Menu Item FieldsCVE-2026-563475.3 Medium
- wwbn avideoAVideo: Stored SSRF via Video EPG Link Missing isSSRFSafeURL() ValidationCVE-2026-347406.5 Medium
- wwbn avideoAVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.phpCVE-2026-347396.1 Medium
- wwbn avideoAVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request ParameterCVE-2026-347384.3 Medium
- wwbn avideoAVideo: Arbitrary Stripe Subscription Cancellation via Debug Endpoint and retrieveSubscriptions() BugCVE-2026-347376.5 Medium
- wwbn avideoAVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI GuardCVE-2026-347336.5 Medium
- wwbn avideoAVideo: Missing Authentication in CreatePlugin list.json.php Template Affects 21 EndpointsCVE-2026-347325.3 Medium
- wwbn avideoAVideo: Unauthenticated Live Stream Termination via RTMP Callback on_publish_done.phpCVE-2026-347317.5 High
- wwbn avideoAVideo: DOM XSS via Unsanitized Display Name in WebSocket Call NotificationCVE-2026-347166.4 Medium
- wwbn avideoAVideo: CSRF on Plugin Enable/Disable Endpoint Allows Disabling Security PluginsCVE-2026-346136.5 Medium
- wwbn avideoAVideo: CSRF on emailAllUsers.json.php Enables Mass Phishing Email to All UsersCVE-2026-346116.5 Medium
- wwbn avideoAVideo: Stored XSS via Unescaped Plugin Configuration Values in Admin PanelCVE-2026-343966.1 Medium
- wwbn avideoAVideo: CSRF on Admin Plugin Configuration Enables Payment Credential HijackingCVE-2026-343948.1 High
- wwbn avideoAVideo: Mass User PII Disclosure via Missing Authorization in YPTWallet users.json.phpCVE-2026-343956.5 Medium
- avideoAVideo - Unauthenticated Access to Payment Log DataTables Endpoints via list.json.phpCVE-2026-563418.7 High
- wwbn avideoAVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment PageCVE-2026-343758.2 High
- wwbn avideoAVideo has SQL Injection in Live_schedule::keyExists() via Unparameterized Stream KeyCVE-2026-343749.1 Critical
- wwbn avideoAVIdeo has Video Password Protection Bypass via API Endpoints Returning Full Playback Sources Without Password VerificationCVE-2026-343695.3 Medium
- wwbn avideoAVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalanceCVE-2026-343685.3 Medium
- wwbn avideoAVideo has User Group-Based Category Access Control Bypass via Missing and Broken Group Filtering in categories.json.phpCVE-2026-343645.3 Medium
- wwbn avideoAVideo's WebSocket Token Never Expires Due to Commented-Out Timeout Validation in verifyTokenSocket()CVE-2026-343625.4 Medium
- wwbn avideoAVideo's IDOR in uploadPoster.php Allows Any Authenticated User to Overwrite Scheduled Live Stream Posters and Trigger False Socket NotificationsCVE-2026-342475.4 Medium
- wwbn avideoAVideo's Missing Authorization in Playlist Schedule Creation Allows Cross-User Broadcast HijackingCVE-2026-342456.3 Medium
- wwbn avideoAVideo has Plaintext Video Password StorageCVE-2026-338679.1 Critical
- wwbn avideoAVideo has SQL Injection in category.php fixCleanTitle() via Unparameterized clean_title and id VariablesCVE-2026-337707.1 High
- wwbn avideoAVideo has SQL Injection via Partial Prepared Statement — videos_id Concatenated Directly into QueryCVE-2026-33767Fix available7.1 High
- wwbn avideoAVideo has SSRF Protection Bypass via HTTP Redirect in Image Download EndpointsCVE-2026-337665.3 Medium
- wwbn avideoAVideo: IDOR in AI Plugin Allows Stealing Other Users' AI-Generated Metadata and TranscriptionsCVE-2026-337644.3 Medium
- wwbn avideoAVideo has an Unauthenticated Video Password Brute-Force Vulnerability via Unrate-Limited Boolean OracleCVE-2026-337635.3 Medium
- wwbn avideoAVideo: Unauthenticated Access to Scheduler Plugin Endpoints Leaks Scheduled Tasks, Email Content, and User MappingsCVE-2026-337615.3 Medium
- wwbn avideoAVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist ContentsCVE-2026-337595.3 Medium
- wwbn avideoAVideo Vulnerable to SQL Injection in Subscribe Endpoint via Unsanitized user_id Parameter in subscribe.phpCVE-2026-337237.1 High
- wwbn avideoAVideo Vulnerable to Unauthenticated CDN Configuration Takeover via Empty Default Key Bypass and Mass-Assignment in status.json.phpCVE-2026-337198.6 High
- wwbn avideoAVideo Vulnerable to Remote Code Execution via Persistent PHP Temp File in Encoder downloadURL with Resolution Validation AbortCVE-2026-337178.8 High
- wwbn avideoAVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.phpCVE-2026-337169.4 Critical
- wwbn avideoAVideo vulnerable to IP Address Spoofing via Untrusted HTTP Headers in getRealIpAddr()CVE-2026-336905.3 Medium
- wwbn avideoAVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery EndpointCVE-2026-336885.3 Medium
- wwbn avideoAVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User DataCVE-2026-336855.3 Medium
- wwbn avideoAVideo vulnerable to Stored XSS via html_entity_decode() Reversing xss_esc() Sanitization in Channel About FieldCVE-2026-336835.4 Medium
- wwbn avideoAVideo has Path Traversal in pluginRunDatabaseScript.json.php Enables Arbitrary SQL File Execution via Unsanitized Plugin NameCVE-2026-336817.2 High
- wwbn avideoAVideo has a Blind SQL Injection in Live Schedule Reminder via Unsanitized live_schedule_id in Scheduler_commands::getAllActiveOrToRepeat()CVE-2026-336518.1 High
- wwbn avideoAVideo's Video Moderator Privilege Escalation via Ownership Transfer Enables Arbitrary Video DeletionCVE-2026-336507.6 High
- wwbn avideoAVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission ModificationCVE-2026-336498.1 High
- Show moreLoading…