Wwbn vulnerabilities
345 CVEs and advisories name Wwbn as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-33478AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection
- CVE-2026-33354AVideo has an authenticated arbitrary local file read via `chunkFile` path injection in `aVideoEncoder.json.php`
- CVE-2026-33352AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass)
- CVE-2026-33351AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass
- CVE-2026-33297AVideo has an IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.php
- CVE-2026-33296AVideo has an Open Redirect via Unvalidated redirectUri in userLogin.php
- CVE-2026-33295AVideo Vulnerable to Stored XSS via Unescaped Video Title in CDN downloadButtons.php
- CVE-2026-33294AVideo has SSRF in BulkEmbed Thumbnail Fetch that Allows Reading Internal Network Resources
- CVE-2026-33293AVideo Affected by Arbitrary File Deletion via Path Traversal in CloneSite deleteDump Parameter
- CVE-2026-33319AVideo Vulnerable to OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command
- CVE-2026-33292AVideo has Authorization Bypass via Path Traversal in HLS Endpoint Allows Streaming Private/Paid Videos
- CVE-2026-33238AVideo has a Path Traversal in listFiles.json.php that Enables Server Filesystem Enumeration
- CVE-2026-33237AVideo has SSRF in Scheduler Plugin via callbackURL Missing `isSSRFSafeURL()` Validation
- CVE-2026-33043AVideo affected by Session Hijacking via Unauthenticated Session ID Disclosure with Permissive CORS
- CVE-2026-33041AVideo has an Unauthenticated Password Hash Oracle via encryptPass.json.php
- CVE-2026-33039AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy
- CVE-2026-33038AVideo affected by unauthenticated application takeover via exposed web installer on uninitialized deployments
- CVE-2026-33037WWBN AVideo has predictable default admin credentials in official Docker deployment path
- CVE-2026-33035Unauthenticated Reflected XSS via innerHTML in AVideo
- CVE-2026-33025AVideo-Encoder is Vulnerable to Authenticated SQL Injection via ORDER BY Clause
- CVE-2026-33024AVideo-Encoder has Unauthenticated Blind Server-Side Request Forgery via Public Thumbnail Generator
- CVE-2026-30885WWBN AVideo - Unauthenticated IDOR - Playlist Information Disclosure
- CVE-2026-29058AVideo: Unauthenticated OS Command Injection via base64Url in objects/getImage.php
- CVE-2026-28501WWBN AVideo: Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php
- CVE-2026-28502WWBN AVideo: Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction
- CVE-2026-29093WWBN AVideo: Unauthenticated PHP session store exposed to host network via published memcached port
- CVE-2026-27732AVideo has Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.php
- CVE-2026-27568AVideo has Stored Cross-Site Scripting via Markdown Comment Injection
- CVE-2025-46410A cross-site scripting (xss) vulnerability exists in the managerPlaylists PlaylistOwnerUsersId parameter functionality of WWBN AVideo 14.4 a
- CVE-2025-53084A cross-site scripting (xss) vulnerability exists in the videosList page parameter functionality of WWBN AVideo 14.4 and dev master commit 8