Skip to contentWwbn vulnerabilities
Newest
- wwbn avideoWWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery SectionCVE-2026-501834.7 Medium
- wwbn avideoAVideo Has Unauthenticated Reflected XSS via $_GET['search'] in YouTubeAPI Gallery PaginationCVE-2026-501826.1 Medium
- wwbn avideoWWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass)CVE-2026-492797.7 High
- wwbn avideoWWBN AVideo: Stored XSS via unescaped Gallery category descriptionCVE-2026-476945.4 Medium
- wwbn avideoWWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpointCVE-2026-476967.1 High
- wwbn avideoWWBN AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php`CVE-2026-463376.9 Medium
- wwbn avideoWWBN AVideo: Authenticated Arbitrary File Read in view/update.phpCVE-2026-457316.9 Medium
- wwbn avideoAVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumerationCVE-2026-456205.3 Medium
- wwbn avideoAVideo CVE-2026-43884 incomplete fix - `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD postCVE-2026-456196.5 Medium
- wwbn avideoWWBN AVideo plugin/LoginControl/set.json.php: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FACVE-2026-456105.7 Medium
- wwbn avideoWWBN AVideo Live: stored XSS via unescaped stream key in modeYoutubeLive.php class attributeCVE-2026-455805.4 Medium
- wwbn avideoWWBN AVideo Live: OS command injection in on_publish.php execAsync via unescaped m3u8 URLCVE-2026-455788.8 High
- avideoAVideo - Arbitrary User Session Hijacking via Meet Plugin uploadRecordedVideo EndpointCVE-2026-563459.2 Critical
- wwbn avideoWWBN AVideo: Exposure of Sensitive Information to an Unauthorized Actor and Missing AuthorizationCVE-2026-438857.7 High
- wwbn avideoWWBN AVideo: SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL()CVE-2026-438847.7 High
- wwbn avideoWWBN AVideo: IDOR in PayPalYPT agreementCancel.json.php Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription AgreementsCVE-2026-438834.2 Medium
- wwbn avideoWWBN AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event SpoofingCVE-2026-438824.3 Medium
- wwbn avideoWWBN AVideo: Unauthenticated User Enumeration in `objects/users.json.php` via `isCompany` Parameter Flips `$ignoreAdmin = true` and Defeats Admin-Only Listing GuardCVE-2026-438815.3 Medium
- wwbn avideoWWBN AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Allows Phishing from Site's Legitimate From AddressCVE-2026-438805.3 Medium
- wwbn avideoWWBN AVideo: Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT_FOLLOWLOCATION Redirect BypassCVE-2026-438795.4 Medium
- wwbn avideoWWBN AVideo: Reflected XSS in plugin/Meet/iframe.php via Unescaped `user`/`pass` Parameters Reflected into JavaScript String LiteralCVE-2026-438786.1 Medium
- wwbn avideoWWBN AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Any Logged-in User's Profile Photo with Arbitrary BytesCVE-2026-438775.4 Medium
- wwbn avideoWWBN AVideo: HTML Injection in notifySubscribers.json.php Enables Platform-Branded Phishing Emails to Channel SubscribersCVE-2026-438766.4 Medium
- wwbn avideoWWBN AVideo: Password Hash Leaked in MobileManager OAuth Redirect URL Enables Account TakeoverCVE-2026-438756.8 Medium
- wwbn avideoWWBN AVideo: Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']` Relay BypassCVE-2026-438747.2 High
- wwbn avideoWWBN AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone ServerCVE-2026-438737.5 High
- wwbn avideoWWBN AVideo vulnerable to RCE caused by clonesite pluginCVE-2026-413048.9 High
- wwbn avideoAVideo has an incomplete fix for CVE-2026-33502 (Command Injection)CVE-2026-410649.3 Critical
- wwbn avideoWWBN AVideo has incomplete fix for CVE-2026-33500 (XSS)CVE-2026-410635.4 Medium
- wwbn avideoWWBN/AVideo has an incomplete fix for a directory traversal bypass via query string in ReceiveImage downloadURL parametersCVE-2026-410626.5 Medium
- wwbn avideoWWBN AVideo Vulnerable to stored XSS via Unanchored Duration Regex in Video Encoder ReceiverCVE-2026-410615.4 Medium
- wwbn avideoAVideo's SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURLCVE-2026-410607.7 High
- wwbn avideoAVideo has an incomplete fix for CVE-2026-33293 (Path Traversal) in AVideoCVE-2026-410588.1 High
- wwbn avideoAVideo has CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) that Exposes Authenticated API ResponsesCVE-2026-410577.1 High
- wwbn avideoAVideos has CORS Origin Reflection with Credentials on Sensitive API Endpoints that Enables Cross-Origin Account TakeoverCVE-2026-410568.1 High
- wwbn avideoAVideo has an incomplete fix for CVE-2026-33039 (SSRF)CVE-2026-410558.6 High
- wwbn avideoWWBN/AVideo has CAPTCHA Bypass via Attacker-Controlled Length Parameter and Missing Token Invalidation on FailureCVE-2026-409355.3 Medium
- wwbn avideoWWBN AVideo's missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creatorsCVE-2026-409295.4 Medium
- wwbn avideoAVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset DeletionCVE-2026-409285.4 Medium
- wwbn avideoWWBN AVideo Vulnerable to CSRF in Admin JSON Endpoints (Category CRUD, Plugin Update Script)CVE-2026-409267.1 High
- wwbn avideoWWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP CredentialsCVE-2026-409258.3 High
- wwbn avideoWWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() SinksCVE-2026-4091110.0 Critical
- wwbn avideoWWBN AVideo has a Path Traversal in Locale Save Endpoint that Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE)CVE-2026-409098.7 High
- wwbn avideoWWBN AVideo has an Unauthenticated Information Disclosure via git.json.php that Exposes Developer Emails and Deployed VersionCVE-2026-409085.3 Medium
- wwbn avideoWWBN AVideo has IDOR in Live Restreams list.json.php that Exposes Other Users' Stream Keys and OAuth TokensCVE-2026-409076.5 Medium
- wwbn avideoWWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration (Incomplete fix for CVE-2026-27732)CVE-2026-393707.1 High
- wwbn avideoWWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLsCVE-2026-393697.6 High
- wwbn avideoWWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal servicesCVE-2026-393686.5 Medium
- wwbn avideoWWBN AVideo has Stored XSS via Malicious EPG XML Program Titles in AVideo EPG PageCVE-2026-393675.4 Medium
- wwbn avideoWWBN AVideo Affected by a PayPal IPN Replay Attack Enabling Wallet Balance Inflation via Missing Transaction Deduplication in ipn.phpCVE-2026-393666.5 Medium
- Show moreLoading…