Vulnerability · Published Aug 28, 2026 · Assigned by VulnCheck
CVE-2026-81732WWBN AVideo through 30.0 Information Disclosure via report4.json.php
Medium 6.9
In plain English
A medium-severity information exposure in AVideo from WWBN. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).
Severity (CVSS 4.0)6.9Medium
Exploit odds (30 days)0.6%top 53.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
WWBN AVideo through version 30.0 fails to enforce authentication on the report4.json.php and report4.1.json.php endpoints, allowing unauthenticated access to user registration statistics. Attackers can send GET requests to these endpoints to retrieve daily and cumulative user-registration counts without any session or authorization.
Affected products (as reported)
Weakness: CWE-200 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
References
- GitHub Security Advisory (GHSA-xv5m-gpmp-m72c) vendor-advisory
- VulnCheck Advisory: WWBN AVideo through 30.0 Information Disclosure via report4.json.php third-party-advisory