# cve.now: Wwbn

The newest entries naming Wwbn as an affected vendor (up to 200), of 345 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-126545](https://cve.now/CVE-2026-126545.md): WWBN AVideo through 29.7.1 Missing Authorization via get\_api\_tags API (CVSS 5.3)
- [CVE-2026-126544](https://cve.now/CVE-2026-126544.md): WWBN AVideo 6.5 through 29.7.1 Email Verification Bypass via User::verifyCode() (CVSS 5.3)
- [CVE-2026-126543](https://cve.now/CVE-2026-126543.md): WWBN AVideo through 29.7.1 Wallet Credit Manipulation via PayPalYPT ipnV2.php (CVSS 8.7)
- [CVE-2026-126542](https://cve.now/CVE-2026-126542.md): WWBN AVideo 6.5 through 29.7.1 Authentication Bypass via Hybridauth Social Login (CVSS 9.3)
- [CVE-2026-126541](https://cve.now/CVE-2026-126541.md): WWBN AVideo through 29.7.1 Missing Authorization via Live Restream Endpoints (CVSS 8.6)
- [CVE-2026-124424](https://cve.now/CVE-2026-124424.md): WWBN AVideo Path Traversal Arbitrary VTT File Write via receiveAsync.json.php (CVSS 7.1)
- [CVE-2026-123486](https://cve.now/CVE-2026-123486.md): WWBN AVideo 29.0 through 29.4.0 Race Condition in PayPal IPN Deduplication via ipn.php (CVSS 6.0)
- [CVE-2026-61575](https://cve.now/CVE-2026-61575.md): AVideo-Encoder vulnerable to stored DOM cross-site scripting through queue titles (CVSS 4.7)
- [CVE-2026-61569](https://cve.now/CVE-2026-61569.md): AVideo-Encoder: pre-authentication streamer-login SQL injection (CVSS 7.5)
- [CVE-2026-61571](https://cve.now/CVE-2026-61571.md): AVideo-Encoder: missing authentication on control and status endpoints (CVSS 7.3)
- [CVE-2026-61572](https://cve.now/CVE-2026-61572.md): AVideo-Encoder: unauthenticated full-response server-side request forgery (CVSS 8.6)
- [CVE-2026-61573](https://cve.now/CVE-2026-61573.md): AVideo-Encoder: reflected cross-site scripting in the login interface (CVSS 6.1)
- [CVE-2026-61567](https://cve.now/CVE-2026-61567.md): AVideo-Encoder: unauthenticated command execution through streamer login trust (CVSS 10.0)
- [CVE-2026-61564](https://cve.now/CVE-2026-61564.md): AVideo-Encoder: unauthenticated installer PHP code injection (CVSS 10.0)
- [CVE-2026-116800](https://cve.now/CVE-2026-116800.md): WWBN AVideo before 29.5.0 Local PHP File Inclusion via Accept-Language Header (CVSS 6.9)
- [CVE-2026-116139](https://cve.now/CVE-2026-116139.md): WWBN AVideo 26.0 through 29.3.0 Stored XSS via Comment Markdown Rendering (CVSS 5.1)
- [CVE-2026-114634](https://cve.now/CVE-2026-114634.md): WWBN AVideo before 29.4.0 Blind SSRF via getHeaderContentTypeFromURL Redirect (CVSS 5.3)
- [CVE-2026-114633](https://cve.now/CVE-2026-114633.md): WWBN AVideo before 29.4.0 Incorrect Authorization via confirmDeleteUser.json.php (CVSS 7.0)
- [CVE-2026-114048](https://cve.now/CVE-2026-114048.md): WWBN AVideo before 24.0 CSRF via Legacy Playlist and Video Endpoints (CVSS 5.1)
- [CVE-2026-105086](https://cve.now/CVE-2026-105086.md): WWBN AVideo 12.4 through 29.2.0 Stored XSS via Double-Encoded Video Title (CVSS 9.3)
- [CVE-2026-105089](https://cve.now/CVE-2026-105089.md): WWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHPFlix2 Templates (CVSS 9.3)
- [CVE-2026-100630](https://cve.now/CVE-2026-100630.md): AVideo before 29.1.0 Stored XSS via HTML Entity Bypass in trailer1 Field (CVSS 5.1)
- [CVE-2026-92915](https://cve.now/CVE-2026-92915.md): WWBN AVideo userVerifyEmail.php Unauthenticated Access Control (CVSS 6.9)
- [CVE-2026-92914](https://cve.now/CVE-2026-92914.md): AVideo LoginControl PGP Second Factor Authentication Bypass (CVSS 8.6)
- [CVE-2026-92913](https://cve.now/CVE-2026-92913.md): AVideo Weak PRNG Activation Code Authentication Bypass (CVSS 9.1)
- [CVE-2026-92912](https://cve.now/CVE-2026-92912.md): AVideo Cryptographically Weak PRNG via uniqid Stream Key (CVSS 8.3)
- [CVE-2026-92586](https://cve.now/CVE-2026-92586.md): AVideo through 29.0 Missing Authorization via comment API endpoint (CVSS 5.3)
- [CVE-2026-92585](https://cve.now/CVE-2026-92585.md): AVideo through 29.0 Missing Authorization Check via API Like Endpoint (CVSS 5.3)
- [CVE-2026-92584](https://cve.now/CVE-2026-92584.md): AVideo through 29.0 Stored Cross-Site Scripting via User-Agent Header (CVSS 5.3)
- [CVE-2026-92583](https://cve.now/CVE-2026-92583.md): AVideo through 29.0 Rate Limit Bypass via Non-Atomic Counter Increment (CVSS 6.9)
- [CVE-2026-92582](https://cve.now/CVE-2026-92582.md): AVideo through 29.0 Broken Access Control via videoAddNew.json.php CSRF Bypass (CVSS 7.1)
- [CVE-2026-92581](https://cve.now/CVE-2026-92581.md): AVideo through 29.0 Like Counter Desynchronization via Array Parameter (CVSS 5.3)
- [CVE-2026-92580](https://cve.now/CVE-2026-92580.md): AVideo through 29.0 CloneSite Stored Shell Injection via SSH Password CSRF (CVSS 8.7)
- [CVE-2026-92579](https://cve.now/CVE-2026-92579.md): AVideo through 29.0 Broken Access Control via CSRF Exemption Basename Collision (CVSS 5.3)
- [CVE-2026-92578](https://cve.now/CVE-2026-92578.md): WWBN AVideo through 29.0 Authentication Bypass via Stored Password Hash (CVSS 9.2)
- [CVE-2026-92577](https://cve.now/CVE-2026-92577.md): AVideo through 29.0 API get\_api\_video Broken Access Control via clean\_title (CVSS 8.7)
- [CVE-2026-91967](https://cve.now/CVE-2026-91967.md): AVideo through 29.0 Blind SSRF via getHeaderContentTypeFromURL (CVSS 5.3)
- [CVE-2026-91966](https://cve.now/CVE-2026-91966.md): AVideo through 29.0 Unauthenticated SSRF via Host Header (CVSS 6.9)
- [CVE-2026-91965](https://cve.now/CVE-2026-91965.md): WWBN AVideo through 29.0 Broken Access Control via Live Endpoints (CVSS 8.7)
- [CVE-2026-90552](https://cve.now/CVE-2026-90552.md): WWBN AVideo Missing Authorization via Playlists\_schedules list.json.php (CVSS 5.3)
- [CVE-2026-90551](https://cve.now/CVE-2026-90551.md): WWBN AVideo Missing Authorization via video\_from\_program API (CVSS 6.9)
- [CVE-2026-90550](https://cve.now/CVE-2026-90550.md): WWBN AVideo Missing Authorization via mediaSession.json.php (CVSS 6.9)
- [CVE-2026-90549](https://cve.now/CVE-2026-90549.md): WWBN AVideo Missing Authorization via videosAndroid.json.php Endpoint (CVSS 6.9)
- [CVE-2026-90548](https://cve.now/CVE-2026-90548.md): WWBN AVideo Missing Authorization in ImageGallery list.json.php (CVSS 6.9)
- [CVE-2026-90547](https://cve.now/CVE-2026-90547.md): WWBN AVideo Missing Authorization via getBookmarks.json.php (CVSS 6.9)
- [CVE-2026-90546](https://cve.now/CVE-2026-90546.md): WWBN AVideo Missing Authorization via like.json.php (CVSS 5.3)
- [CVE-2026-90545](https://cve.now/CVE-2026-90545.md): WWBN AVideo Missing Authorization via commentAddNew.json.php (CVSS 5.3)
- [CVE-2026-90544](https://cve.now/CVE-2026-90544.md): WWBN AVideo Missing Authorization via videoAddViewCount.json.php (CVSS 5.3)
- [CVE-2026-90543](https://cve.now/CVE-2026-90543.md): WWBN AVideo Missing Authentication via socketMessageLiveOwner.json.php (CVSS 6.9)
- [CVE-2026-90542](https://cve.now/CVE-2026-90542.md): WWBN AVideo Missing Authorization via remindMe.json.php (CVSS 5.3)
- [CVE-2026-90541](https://cve.now/CVE-2026-90541.md): WWBN AVideo Unauthenticated Information Disclosure via menus.json.php (CVSS 6.9)
- [CVE-2026-90540](https://cve.now/CVE-2026-90540.md): WWBN AVideo Missing Authorization via playListAddVideo.json.php (CVSS 5.3)
- [CVE-2026-90539](https://cve.now/CVE-2026-90539.md): WWBN AVideo Missing Authentication via menuItems.json.php (CVSS 6.9)
- [CVE-2026-90538](https://cve.now/CVE-2026-90538.md): WWBN AVideo Missing Authorization via playlistsFromUser.json.php (CVSS 6.9)
- [CVE-2026-90537](https://cve.now/CVE-2026-90537.md): WWBN AVideo Scheduler sendEmail Missing Authorization via Token (CVSS 8.8)
- [CVE-2026-90536](https://cve.now/CVE-2026-90536.md): WWBN AVideo Missing Authorization via adsInfo API Endpoint (CVSS 6.9)
- [CVE-2026-89257](https://cve.now/CVE-2026-89257.md): AVideo through 29.0 Cross-User Category Asset Deletion via Missing Ownership Check (CVSS 5.3)
- [CVE-2026-89256](https://cve.now/CVE-2026-89256.md): AVideo Bookmark Plugin Stored XSS via Chapter Names (CVSS 9.3)
- [CVE-2026-89255](https://cve.now/CVE-2026-89255.md): AVideo LoginControl Stored XSS via PGP Public Key (CVSS 9.3)
- [CVE-2026-89254](https://cve.now/CVE-2026-89254.md): AVideo CustomizeUser Stored XSS via field\_name Parameter (CVSS 9.3)
- [CVE-2026-89253](https://cve.now/CVE-2026-89253.md): AVideo Stored XSS via donationLink in watch page button (CVSS 9.3)
- [CVE-2026-89252](https://cve.now/CVE-2026-89252.md): AVideo Missing Authorization in addLiveLink.php LiveLink Update (CVSS 7.1)
- [CVE-2026-89251](https://cve.now/CVE-2026-89251.md): AVideo Missing Authorization via AD\_Server log.php Wallet Credit (CVSS 7.1)
- [CVE-2026-89250](https://cve.now/CVE-2026-89250.md): WWBN AVideo Unauthenticated File Read via getRecordedFile.php (CVSS 8.7)
- [CVE-2026-89249](https://cve.now/CVE-2026-89249.md): AVideo YPTWallet Stored XSS via CryptoWallet Configuration (CVSS 9.3)
- [CVE-2026-89248](https://cve.now/CVE-2026-89248.md): AVideo WebRTC Plugin Information Disclosure via status.json.php (CVSS 6.9)
- [CVE-2026-89247](https://cve.now/CVE-2026-89247.md): WWBN AVideo XML Injection via plugin/AD\_Server/VMAP.php (CVSS 5.3)
- [CVE-2026-89246](https://cve.now/CVE-2026-89246.md): WWBN AVideo CSV Formula Injection via myComments.download.php (CVSS 5.1)
- [CVE-2026-89245](https://cve.now/CVE-2026-89245.md): WWBN AVideo Cross-Site Request Forgery via playlistRemove.php (CVSS 7.1)
- [CVE-2026-89244](https://cve.now/CVE-2026-89244.md): WWBN AVideo Reflected XSS via Gallery Category getBackURL (CVSS 5.3)
- [CVE-2026-89243](https://cve.now/CVE-2026-89243.md): WWBN AVideo Stored XSS via UserGroups setGroup\_name (CVSS 9.2)
- [CVE-2026-89242](https://cve.now/CVE-2026-89242.md): WWBN AVideo Unauthenticated SSRF via login.json.php (CVSS 6.9)
- [CVE-2026-89241](https://cve.now/CVE-2026-89241.md): WWBN AVideo Reflected XSS via confirmLivePassword.php (CVSS 5.3)
- [CVE-2026-89240](https://cve.now/CVE-2026-89240.md): WWBN AVideo Reflected XSS via confirmLivePassword.php (CVSS 5.3)
- [CVE-2026-89239](https://cve.now/CVE-2026-89239.md): WWBN AVideo Reflected XSS via Referer Header Comment Breakout (CVSS 5.3)
- [CVE-2026-89148](https://cve.now/CVE-2026-89148.md): AVideo Open Redirect via playlistSort.php Referer Header (CVSS 5.1)
- [CVE-2026-88876](https://cve.now/CVE-2026-88876.md): AVideo PlayerSkins seo.php Missing Authorization Password-Protected VOD (CVSS 8.7)
- [CVE-2026-88875](https://cve.now/CVE-2026-88875.md): AVideo Incomplete API Sanitization Information Disclosure (CVSS 5.3)
- [CVE-2026-88874](https://cve.now/CVE-2026-88874.md): AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 Authentication Bypass (CVSS 8.7)
- [CVE-2026-88873](https://cve.now/CVE-2026-88873.md): WWBN AVideo Cross-Site Request Forgery via logArchive.json.php (CVSS 7.1)
- [CVE-2026-88872](https://cve.now/CVE-2026-88872.md): AVideo CustomizeUser setPassword.json.php CSRF (CVSS 7.1)
- [CVE-2026-88871](https://cve.now/CVE-2026-88871.md): WWBN AVideo CustomizeUser setSubscribers CSRF via GET (CVSS 5.3)
- [CVE-2026-88870](https://cve.now/CVE-2026-88870.md): WWBN AVideo LoginControl PGP Key CSRF via GET Request (CVSS 7.1)
- [CVE-2026-88869](https://cve.now/CVE-2026-88869.md): AVideo AD\_Server Stored XSS via log.php label parameter (CVSS 9.3)
- [CVE-2026-88868](https://cve.now/CVE-2026-88868.md): AVideo LiveLinks Stored XSS via title and description fields (CVSS 9.3)
- [CVE-2026-88867](https://cve.now/CVE-2026-88867.md): WWBN AVideo Stored XSS via Category Name and Icon Class (CVSS 9.3)
- [CVE-2026-88866](https://cve.now/CVE-2026-88866.md): WWBN AVideo LoginControl Stored XSS via User-Agent Header (CVSS 9.3)
- [CVE-2026-88865](https://cve.now/CVE-2026-88865.md): AVideo Missing Authorization via getRestream.json.php (CVSS 8.6)
- [CVE-2026-86729](https://cve.now/CVE-2026-86729.md): WWBN AVideo Unrestricted Authentication Attempts via get\_api\_preauthorize (CVSS 9.1)
- [CVE-2026-86728](https://cve.now/CVE-2026-86728.md): AVideo through 29.0 Unauthenticated Disclosure via epg.json.php (CVSS 8.7)
- [CVE-2026-86727](https://cve.now/CVE-2026-86727.md): AVideo through 29.0 Information Disclosure via stats.json.php (CVSS 8.7)
- [CVE-2026-86726](https://cve.now/CVE-2026-86726.md): AVideo through 29.0 Information Disclosure via restreamsActive.json.php (CVSS 7.1)
- [CVE-2026-86725](https://cve.now/CVE-2026-86725.md): AVideo SocialMediaPublisher Missing Authorization via add.json.php (CVSS 7.1)
- [CVE-2026-86724](https://cve.now/CVE-2026-86724.md): AVideo YPTWallet saveBalance.php Cross-Site Request Forgery (CVSS 7.1)
- [CVE-2026-86723](https://cve.now/CVE-2026-86723.md): AVideo LoginControl PGP Authentication Bypass via verifyChallenge (CVSS 8.6)
- [CVE-2026-86722](https://cve.now/CVE-2026-86722.md): AVideo Authentication Bypass via SQL Cache Invalidation (CVSS 8.6)
- [CVE-2026-86721](https://cve.now/CVE-2026-86721.md): AVideo through c3edcc274c Authorization Bypass via Session Cookie (CVSS 8.7)
- [CVE-2026-86720](https://cve.now/CVE-2026-86720.md): WWBN AVideo Missing Authorization via resendRestreamer.json.php (CVSS 8.6)
- [CVE-2026-86719](https://cve.now/CVE-2026-86719.md): WWBN AVideo CustomizeUser Cross-Site Request Forgery Session Hijacking (CVSS 5.3)
- [CVE-2026-86718](https://cve.now/CVE-2026-86718.md): WWBN AVideo Cross-Site Request Forgery via deleteHistory.json.php (CVSS 7.1)
- [CVE-2026-86190](https://cve.now/CVE-2026-86190.md): WWBN AVideo Broken Access Control via videoViewsInfo hash Parameter (CVSS 9.3)
- [CVE-2026-86189](https://cve.now/CVE-2026-86189.md): WWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg.json.php (CVSS 9.3)
- [CVE-2026-86188](https://cve.now/CVE-2026-86188.md): AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting (CVSS 6.9)
- [CVE-2026-86187](https://cve.now/CVE-2026-86187.md): WWBN AVideo Weak PRNG Password Generation via External Login (CVSS 7.4)
- [CVE-2026-86186](https://cve.now/CVE-2026-86186.md): AVideo API Rate Limit Bypass via Bot User-Agent Header (CVSS 6.3)
- [CVE-2026-85577](https://cve.now/CVE-2026-85577.md): AVideo userLogin.php Reflected XSS via error parameter (CVSS 5.3)
- [CVE-2026-85164](https://cve.now/CVE-2026-85164.md): WWBN AVideo Server-Side Request Forgery via set\_api\_userImages (CVSS 7.1)
- [CVE-2026-85163](https://cve.now/CVE-2026-85163.md): AVideo Server-Side Request Forgery via epg\_link parameter (CVSS 7.1)
- [CVE-2026-85162](https://cve.now/CVE-2026-85162.md): AVideo through c91b5975d CSRF via saveLive.php (CVSS 7.1)
- [CVE-2026-85161](https://cve.now/CVE-2026-85161.md): AVideo removePoster.php Cross-Site Request Forgery File Deletion (CVSS 5.3)
- [CVE-2026-85160](https://cve.now/CVE-2026-85160.md): AVideo through c91b5975d CSRF and Path Traversal via stopLive.php (CVSS 7.2)
- [CVE-2026-85159](https://cve.now/CVE-2026-85159.md): AVideo Reflected XSS via cancelUri in userLogin.php (CVSS 5.3)
- [CVE-2026-85158](https://cve.now/CVE-2026-85158.md): AVideo Reflected XSS via videoEmbeded.php link parameter (CVSS 5.3)
- [CVE-2026-85157](https://cve.now/CVE-2026-85157.md): WWBN AVideo Broken Access Control via feed/index.php program\_id (CVSS 6.9)
- [CVE-2026-85156](https://cve.now/CVE-2026-85156.md): WWBN AVideo Broken Access Control via Channel Page (CVSS 6.9)
- [CVE-2026-85155](https://cve.now/CVE-2026-85155.md): WWBN AVideo SQL Injection via get.json.php APIName channels (CVSS 8.7)
- [CVE-2026-85154](https://cve.now/CVE-2026-85154.md): WWBN AVideo Authentication Bypass via Non-Expiring video\_id\_hash (CVSS 9.3)
- [CVE-2026-84483](https://cve.now/CVE-2026-84483.md): WWBN AVideo Unauthenticated Password Hash Oracle via encryptPass.json.php (CVSS 6.9)
- [CVE-2026-84482](https://cve.now/CVE-2026-84482.md): WWBN AVideo Cross-Site Request Forgery via get\_domain() validation (CVSS 8.7)
- [CVE-2026-84481](https://cve.now/CVE-2026-84481.md): WWBN AVideo through 30.0 Information Disclosure via MobileManager (CVSS 6.9)
- [CVE-2026-84480](https://cve.now/CVE-2026-84480.md): WWBN AVideo Password Recovery Token Expiration Bypass (CVSS 9.3)
- [CVE-2026-84479](https://cve.now/CVE-2026-84479.md): WWBN AVideo Authentication Bypass via User-Agent Header (CVSS 9.3)
- [CVE-2026-84478](https://cve.now/CVE-2026-84478.md): WWBN AVideo Unauthenticated Arbitrary Log File Deletion (CVSS 6.9)
- [CVE-2026-84477](https://cve.now/CVE-2026-84477.md): AVideo Stored XSS via Live Schedule Title Description (CVSS 5.1)
- [CVE-2026-84476](https://cve.now/CVE-2026-84476.md): WWBN AVideo Authentication Bypass via X-Real-IP Header (CVSS 8.7)
- [CVE-2026-84208](https://cve.now/CVE-2026-84208.md): AVideo User\_Location Plugin Unauthenticated SQL Injection (CVSS 8.7)
- [CVE-2026-84187](https://cve.now/CVE-2026-84187.md): AVideo on\_publish.php Missing Authentication Check via RTMP Callback (CVSS 8.8)
- [CVE-2026-83595](https://cve.now/CVE-2026-83595.md): AVideo Cross-Site Request Forgery via plugin/API/set.json.php (CVSS 7.2)
- [CVE-2026-82648](https://cve.now/CVE-2026-82648.md): WWBN AVideo SSRF Filter Bypass via NAT64 Hex Address (CVSS 7.1)
- [CVE-2026-82647](https://cve.now/CVE-2026-82647.md): WWBN AVideo Cross-Site Request Forgery via sendEmail.json.php (CVSS 5.3)
- [CVE-2026-82646](https://cve.now/CVE-2026-82646.md): WWBN AVideo Unauthenticated Reflected XSS via url2Embed.json.php (CVSS 5.3)
- [CVE-2026-82645](https://cve.now/CVE-2026-82645.md): AVideo Unauthenticated Stream Credential Disclosure via Forgeable Token (CVSS 9.2)
- [CVE-2026-82644](https://cve.now/CVE-2026-82644.md): WWBN AVideo Brute-force Rate Limiting Bypass via Missing User-Agent (CVSS 8.7)
- [CVE-2026-82643](https://cve.now/CVE-2026-82643.md): WWBN AVideo Unauthenticated Rate Limit Bypass via preauthorize.json.php (CVSS 6.9)
- [CVE-2026-81733](https://cve.now/CVE-2026-81733.md): WWBN AVideo through 30.0 CSRF via myLiveControls.save.json.php (CVSS 5.1)
- [CVE-2026-81732](https://cve.now/CVE-2026-81732.md): WWBN AVideo through 30.0 Information Disclosure via report4.json.php (CVSS 6.9)
- [CVE-2026-81678](https://cve.now/CVE-2026-81678.md): AVideo SSRF Guard Bypass via IPv6 Transition Addresses (CVSS 6.9)
- [CVE-2026-59808](https://cve.now/CVE-2026-59808.md): AVideo Authentication Bypass via Unkeyed Video Hash Disclosure (CVSS 8.7)
- [CVE-2026-59256](https://cve.now/CVE-2026-59256.md): WWBN AVideo Unbound Token Authorization Bypass via Gallery (CVSS 8.7)
- [CVE-2026-58003](https://cve.now/CVE-2026-58003.md): WWBN AVideo Cross-Site Request Forgery via releaseVideoNow.json.php (CVSS 7.1)
- [CVE-2026-58002](https://cve.now/CVE-2026-58002.md): WWBN AVideo Authorization Bypass via Users\_affiliations add.json.php (CVSS 7.1)
- [CVE-2026-58001](https://cve.now/CVE-2026-58001.md): WWBN AVideo Cross-Site Request Forgery via videoEditLight.php (CVSS 6.9)
- [CVE-2026-57944](https://cve.now/CVE-2026-57944.md): AVideo channelToGallery.json.php Cross-Site Request Forgery (CVSS 5.3)
- [CVE-2026-56380](https://cve.now/CVE-2026-56380.md): AVideo feed/index.php Exposure of Channel Owner Email Address (CVSS 6.9)
- [CVE-2026-72748](https://cve.now/CVE-2026-72748.md): AVideo Unauthenticated Arbitrary File Write via aVideoEncoderChunk.json.php (CVSS 6.9)
- [CVE-2026-72747](https://cve.now/CVE-2026-72747.md): AVideo Stored Cross-Site Scripting via Unauthenticated Registration (CVSS 5.1)
- [CVE-2026-64626](https://cve.now/CVE-2026-64626.md): AVideo Encoder downloadURL SSRF via unpinned retry fallback (CVSS 5.3)
- [CVE-2026-64625](https://cve.now/CVE-2026-64625.md): AVideo before 29.0 OS Command Injection via execAsync (CVSS 9.3)
- [CVE-2026-33731](https://cve.now/CVE-2026-33731.md): AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data (CVSS 6.5)
- [CVE-2026-55173](https://cve.now/CVE-2026-55173.md): AVideo incomplete fix for CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command execution at the same execAsync sh -c sink (CVSS 8.1)
- [CVE-2026-33692](https://cve.now/CVE-2026-33692.md): AVideo Has Unauthenticated .env File Exposure via Official Docker Compose Configuration (CVSS 7.5)
- [CVE-2026-63305](https://cve.now/CVE-2026-63305.md): AVideo through 29.0 OS Command Injection via ffmpeg.json.php (CVSS 9.2)
- [CVE-2026-63304](https://cve.now/CVE-2026-63304.md): AVideo through 29.0 OS Command Injection via listFFmpegProcesses (CVSS 9.2)
- [CVE-2026-54458](https://cve.now/CVE-2026-54458.md): AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin (CVSS 9.6)
- [CVE-2026-50183](https://cve.now/CVE-2026-50183.md): WWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery Section (CVSS 4.7)
- [CVE-2026-50182](https://cve.now/CVE-2026-50182.md): AVideo Has Unauthenticated Reflected XSS via $\_GET\['search'\] in YouTubeAPI Gallery Pagination (CVSS 6.1)
- [CVE-2026-49279](https://cve.now/CVE-2026-49279.md): WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass) (CVSS 7.7)
- [CVE-2026-33684](https://cve.now/CVE-2026-33684.md): AVideo's Privilege AVideo: Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet Permissions (CVSS 5.3)
- [CVE-2026-56347](https://cve.now/CVE-2026-56347.md): AVideo TopMenu Plugin - Stored Cross-Site Scripting via Unescaped Menu Item Fields (CVSS 5.3)
- [CVE-2026-45580](https://cve.now/CVE-2026-45580.md): WWBN AVideo Live: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute (CVSS 5.4)
- [CVE-2026-45578](https://cve.now/CVE-2026-45578.md): WWBN AVideo Live: OS command injection in on\_publish.php execAsync via unescaped m3u8 URL (CVSS 8.8)
- [CVE-2026-45610](https://cve.now/CVE-2026-45610.md): WWBN AVideo plugin/LoginControl/set.json.php: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA (CVSS 5.7)
- [CVE-2026-45619](https://cve.now/CVE-2026-45619.md): AVideo CVE-2026-43884 incomplete fix - \`isSSRFSafeURL()\` call sites still discard the \`$resolvedIP\` out-param at master HEAD post (CVSS 6.5)
- [CVE-2026-45620](https://cve.now/CVE-2026-45620.md): AVideo CVE-2026-43881 incomplete fix - \`objects/mention.json.php:17\` is an unauthenticated user enumeration (CVSS 5.3)
- [CVE-2026-45731](https://cve.now/CVE-2026-45731.md): WWBN AVideo: Authenticated Arbitrary File Read in view/update.php (CVSS 6.9)
- [CVE-2026-46337](https://cve.now/CVE-2026-46337.md): WWBN AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in \`view/img/image404Raw.php\` (CVSS 6.9)
- [CVE-2026-47694](https://cve.now/CVE-2026-47694.md): WWBN AVideo: Stored XSS via unescaped Gallery category description (CVSS 5.4)
- [CVE-2026-47696](https://cve.now/CVE-2026-47696.md): WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint (CVSS 7.1)
- [CVE-2026-43885](https://cve.now/CVE-2026-43885.md): WWBN AVideo: Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization (CVSS 7.7)
- [CVE-2026-43884](https://cve.now/CVE-2026-43884.md): WWBN AVideo: SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL() (CVSS 7.7)
- [CVE-2026-43883](https://cve.now/CVE-2026-43883.md): WWBN AVideo: IDOR in PayPalYPT agreementCancel.json.php Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription Agreements (CVSS 4.2)
- [CVE-2026-43882](https://cve.now/CVE-2026-43882.md): WWBN AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event Spoofing (CVSS 4.3)
- [CVE-2026-43881](https://cve.now/CVE-2026-43881.md): WWBN AVideo: Unauthenticated User Enumeration in \`objects/users.json.php\` via \`isCompany\` Parameter Flips \`$ignoreAdmin = true\` and Defeats Admin-Only Listing Guard (CVSS 5.3)
- [CVE-2026-43880](https://cve.now/CVE-2026-43880.md): WWBN AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Allows Phishing from Site's Legitimate From Address (CVSS 5.3)
- [CVE-2026-43879](https://cve.now/CVE-2026-43879.md): WWBN AVideo: Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT\_FOLLOWLOCATION Redirect Bypass (CVSS 5.4)
- [CVE-2026-43878](https://cve.now/CVE-2026-43878.md): WWBN AVideo: Reflected XSS in plugin/Meet/iframe.php via Unescaped \`user\`/\`pass\` Parameters Reflected into JavaScript String Literal (CVSS 6.1)
- [CVE-2026-43877](https://cve.now/CVE-2026-43877.md): WWBN AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Any Logged-in User's Profile Photo with Arbitrary Bytes (CVSS 5.4)
- [CVE-2026-43876](https://cve.now/CVE-2026-43876.md): WWBN AVideo: HTML Injection in notifySubscribers.json.php Enables Platform-Branded Phishing Emails to Channel Subscribers (CVSS 6.4)
- [CVE-2026-43875](https://cve.now/CVE-2026-43875.md): WWBN AVideo: Password Hash Leaked in MobileManager OAuth Redirect URL Enables Account Takeover (CVSS 6.8)
- [CVE-2026-43873](https://cve.now/CVE-2026-43873.md): WWBN AVideo: Unauthenticated Disclosure of CloneSite \`myKey\` via Error Echo in \`cloneClient.json.php\` Enables Cross-Site DB Dump of the Configured Clone Server (CVSS 7.5)
- [CVE-2026-43874](https://cve.now/CVE-2026-43874.md): WWBN AVideo: Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via \`$msg\['json'\]\` Relay Bypass (CVSS 7.2)
- [CVE-2026-41304](https://cve.now/CVE-2026-41304.md): WWBN AVideo vulnerable to RCE caused by clonesite plugin (CVSS 8.9)
- [CVE-2026-41064](https://cve.now/CVE-2026-41064.md): AVideo has an incomplete fix for CVE-2026-33502 (Command Injection) (CVSS 9.3)
- [CVE-2026-41063](https://cve.now/CVE-2026-41063.md): WWBN AVideo has incomplete fix for CVE-2026-33500 (XSS) (CVSS 5.4)
- [CVE-2026-41062](https://cve.now/CVE-2026-41062.md): WWBN/AVideo has an incomplete fix for a directory traversal bypass via query string in ReceiveImage downloadURL parameters (CVSS 6.5)
- [CVE-2026-41061](https://cve.now/CVE-2026-41061.md): WWBN AVideo Vulnerable to stored XSS via Unanchored Duration Regex in Video Encoder Receiver (CVSS 5.4)
- [CVE-2026-41060](https://cve.now/CVE-2026-41060.md): AVideo's SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL (CVSS 7.7)
- [CVE-2026-41058](https://cve.now/CVE-2026-41058.md): AVideo has an incomplete fix for CVE-2026-33293 (Path Traversal) in AVideo (CVSS 8.1)
- [CVE-2026-41057](https://cve.now/CVE-2026-41057.md): AVideo has CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) that Exposes Authenticated API Responses (CVSS 7.1)
- [CVE-2026-41056](https://cve.now/CVE-2026-41056.md): AVideos has CORS Origin Reflection with Credentials on Sensitive API Endpoints that Enables Cross-Origin Account Takeover (CVSS 8.1)
- [CVE-2026-41055](https://cve.now/CVE-2026-41055.md): AVideo has an incomplete fix for CVE-2026-33039 (SSRF) (CVSS 8.6)
- [CVE-2026-40935](https://cve.now/CVE-2026-40935.md): WWBN/AVideo has CAPTCHA Bypass via Attacker-Controlled Length Parameter and Missing Token Invalidation on Failure (CVSS 5.3)
- [CVE-2026-40929](https://cve.now/CVE-2026-40929.md): WWBN AVideo's missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creators (CVSS 5.4)
- [CVE-2026-40928](https://cve.now/CVE-2026-40928.md): AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset Deletion (CVSS 5.4)
- [CVE-2026-40926](https://cve.now/CVE-2026-40926.md): WWBN AVideo Vulnerable to CSRF in Admin JSON Endpoints (Category CRUD, Plugin Update Script) (CVSS 7.1)
- [CVE-2026-40925](https://cve.now/CVE-2026-40925.md): WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials (CVSS 8.3)
- [CVE-2026-40911](https://cve.now/CVE-2026-40911.md): WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks (CVSS 10.0)
- [CVE-2026-40909](https://cve.now/CVE-2026-40909.md): WWBN AVideo has a Path Traversal in Locale Save Endpoint that Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE) (CVSS 8.7)
- [CVE-2026-40908](https://cve.now/CVE-2026-40908.md): WWBN AVideo has an Unauthenticated Information Disclosure via git.json.php that Exposes Developer Emails and Deployed Version (CVSS 5.3)
- [CVE-2026-40907](https://cve.now/CVE-2026-40907.md): WWBN AVideo has IDOR in Live Restreams list.json.php that Exposes Other Users' Stream Keys and OAuth Tokens (CVSS 6.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/wwbn
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.