Wwbn vulnerabilities
345 CVEs and advisories name Wwbn as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-43874WWBN AVideo: Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']` Relay Bypass
- CVE-2026-41304WWBN AVideo vulnerable to RCE caused by clonesite plugin
- CVE-2026-41064AVideo has an incomplete fix for CVE-2026-33502 (Command Injection)
- CVE-2026-41063WWBN AVideo has incomplete fix for CVE-2026-33500 (XSS)
- CVE-2026-41062WWBN/AVideo has an incomplete fix for a directory traversal bypass via query string in ReceiveImage downloadURL parameters
- CVE-2026-41061WWBN AVideo Vulnerable to stored XSS via Unanchored Duration Regex in Video Encoder Receiver
- CVE-2026-41060AVideo's SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL
- CVE-2026-41058AVideo has an incomplete fix for CVE-2026-33293 (Path Traversal) in AVideo
- CVE-2026-41057AVideo has CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) that Exposes Authenticated API Responses
- CVE-2026-41056AVideos has CORS Origin Reflection with Credentials on Sensitive API Endpoints that Enables Cross-Origin Account Takeover
- CVE-2026-41055AVideo has an incomplete fix for CVE-2026-33039 (SSRF)
- CVE-2026-40935WWBN/AVideo has CAPTCHA Bypass via Attacker-Controlled Length Parameter and Missing Token Invalidation on Failure
- CVE-2026-40929WWBN AVideo's missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creators
- CVE-2026-40928AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset Deletion
- CVE-2026-40926WWBN AVideo Vulnerable to CSRF in Admin JSON Endpoints (Category CRUD, Plugin Update Script)
- CVE-2026-40925WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials
- CVE-2026-40911WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks
- CVE-2026-40909WWBN AVideo has a Path Traversal in Locale Save Endpoint that Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE)
- CVE-2026-40908WWBN AVideo has an Unauthenticated Information Disclosure via git.json.php that Exposes Developer Emails and Deployed Version
- CVE-2026-40907WWBN AVideo has IDOR in Live Restreams list.json.php that Exposes Other Users' Stream Keys and OAuth Tokens
- CVE-2026-39370WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration (Incomplete fix for CVE-2026-27732)
- CVE-2026-39369WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLs
- CVE-2026-39368WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services
- CVE-2026-39367WWBN AVideo has Stored XSS via Malicious EPG XML Program Titles in AVideo EPG Page
- CVE-2026-39366WWBN AVideo Affected by a PayPal IPN Replay Attack Enabling Wallet Balance Inflation via Missing Transaction Deduplication in ipn.php
- CVE-2026-35452WWBN AVideo has Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php
- CVE-2026-35450WWBN AVideo has Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php
- CVE-2026-35449WWBN AVideo has Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.php
- CVE-2026-35448WWBN AVideo Provides Unauthenticated Access to Payment Order Data via BlockonomicsYPT check.php
- CVE-2026-35181WWBN AVideo Affected by CSRF on Player Skin Configuration via admin/playerUpdate.json.php