WWBN AVideo

• CVE-2026-45731 Medium 6.9 WWBN AVideo: Authenticated Arbitrary File Read in view/update.php 0.5%
• CVE-2026-46337 Medium 6.9 WWBN AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php` 0.5%
• CVE-2026-47694 Medium 5.4 WWBN AVideo: Stored XSS via unescaped Gallery category description 0.2%
• CVE-2026-47696 High 7.1 WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint 0.1%
• CVE-2026-43885 High 7.7 WWBN AVideo: Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization 0.3%
• CVE-2026-43884 High 7.7 WWBN AVideo: SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL() 0.3%
• CVE-2026-43883 Medium 4.2 WWBN AVideo: IDOR in PayPalYPT agreementCancel.json.php Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription Agreements 0.2%
• CVE-2026-43882 Medium 4.3 WWBN AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event Spoofing 0.2%
• CVE-2026-43881 Medium 5.3 WWBN AVideo: Unauthenticated User Enumeration in `objects/users.json.php` via `isCompany` Parameter Flips `$ignoreAdmin = true` and Defeats Admin-Only Listing Guard 0.3%
• CVE-2026-43880 Medium 5.3 WWBN AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Allows Phishing from Site's Legitimate From Address 0.3%
• CVE-2026-43879 Medium 5.4 WWBN AVideo: Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT_FOLLOWLOCATION Redirect Bypass 0.2%
• CVE-2026-43878 Medium 6.1 WWBN AVideo: Reflected XSS in plugin/Meet/iframe.php via Unescaped `user`/`pass` Parameters Reflected into JavaScript String Literal 0.3%
• CVE-2026-43877 Medium 5.4 WWBN AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Any Logged-in User's Profile Photo with Arbitrary Bytes 0.1%
• CVE-2026-43876 Medium 6.4 WWBN AVideo: HTML Injection in notifySubscribers.json.php Enables Platform-Branded Phishing Emails to Channel Subscribers 0.2%
• CVE-2026-43875 Medium 6.8 WWBN AVideo: Password Hash Leaked in MobileManager OAuth Redirect URL Enables Account Takeover 0.3%
• CVE-2026-43873 High 7.5 WWBN AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone Server 0.3%
• CVE-2026-43874 High 7.2 WWBN AVideo: Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']` Relay Bypass 0.3%
• CVE-2026-41304 High 8.9 WWBN AVideo vulnerable to RCE caused by clonesite plugin 2.2%
• CVE-2026-41064 Critical 9.3 AVideo has an incomplete fix for CVE-2026-33502 (Command Injection) 0.3%
• CVE-2026-41063 Medium 5.4 WWBN AVideo has incomplete fix for CVE-2026-33500 (XSS) 0.2%
• CVE-2026-41062 Medium 6.5 WWBN/AVideo has an incomplete fix for a directory traversal bypass via query string in ReceiveImage downloadURL parameters 0.7%
• CVE-2026-41061 Medium 5.4 WWBN AVideo Vulnerable to stored XSS via Unanchored Duration Regex in Video Encoder Receiver 0.2%
• CVE-2026-41060 High 7.7 AVideo's SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL 0.3%
• CVE-2026-41058 High 8.1 AVideo has an incomplete fix for CVE-2026-33293 (Path Traversal) in AVideo 0.5%
• CVE-2026-41057 High 7.1 AVideo has CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) that Exposes Authenticated API Responses 0.1%
• CVE-2026-41056 High 8.1 AVideos has CORS Origin Reflection with Credentials on Sensitive API Endpoints that Enables Cross-Origin Account Takeover 0.3%
• CVE-2026-41055 High 8.6 AVideo has an incomplete fix for CVE-2026-33039 (SSRF) 0.4%
• CVE-2026-40935 Medium 5.3 WWBN/AVideo has CAPTCHA Bypass via Attacker-Controlled Length Parameter and Missing Token Invalidation on Failure 0.2%
• CVE-2026-40929 Medium 5.4 WWBN AVideo's missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creators 0.1%
• CVE-2026-40928 Medium 5.4 AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset Deletion 0.1%
• CVE-2026-40926 High 7.1 WWBN AVideo Vulnerable to CSRF in Admin JSON Endpoints (Category CRUD, Plugin Update Script) 0.2%
• CVE-2026-40925 High 8.3 WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials 0.2%
• CVE-2026-40911 Critical 10.0 WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks 0.6%
• CVE-2026-40909 High 8.7 WWBN AVideo has a Path Traversal in Locale Save Endpoint that Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE) 0.7%
• CVE-2026-40908 Medium 5.3 WWBN AVideo has an Unauthenticated Information Disclosure via git.json.php that Exposes Developer Emails and Deployed Version 0.2%
• CVE-2026-40907 Medium 6.5 WWBN AVideo has IDOR in Live Restreams list.json.php that Exposes Other Users' Stream Keys and OAuth Tokens 0.3%
• CVE-2026-39370 High 7.1 WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration (Incomplete fix for CVE-2026-27732) 0.2%
• CVE-2026-39369 High 7.6 WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLs 0.4%
• CVE-2026-39368 Medium 6.5 WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services 0.2%
• CVE-2026-39367 Medium 5.4 WWBN AVideo has Stored XSS via Malicious EPG XML Program Titles in AVideo EPG Page 0.2%
• CVE-2026-39366 Medium 6.5 WWBN AVideo Affected by a PayPal IPN Replay Attack Enabling Wallet Balance Inflation via Missing Transaction Deduplication in ipn.php 0.2%
• CVE-2026-35452 Medium 5.3 WWBN AVideo has Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php 0.4%
• CVE-2026-35450 Medium 5.3 WWBN AVideo has Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php 0.4%
• CVE-2026-35449 Medium 5.3 WWBN AVideo has Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.php 0.3%
• CVE-2026-35448 Low 3.7 WWBN AVideo Provides Unauthenticated Access to Payment Order Data via BlockonomicsYPT check.php 0.3%
• CVE-2026-35181 Medium 4.3 WWBN AVideo Affected by CSRF on Player Skin Configuration via admin/playerUpdate.json.php 0.1%
• CVE-2026-35180 Medium 4.3 WWBN AVideo affected by CSRF on Site Customization Endpoint Enables Logo Overwrite via Base64 File Write 0.1%
• CVE-2026-35179 Medium 5.3 WWBN AVideo Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php 0.2%
• CVE-2026-34740 Medium 6.5 AVideo: Stored SSRF via Video EPG Link Missing isSSRFSafeURL() Validation 0.3%
• CVE-2026-34739 Medium 6.1 AVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.php 0.2%