Wwbn vulnerabilities
345 CVEs and advisories name Wwbn as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-35180WWBN AVideo affected by CSRF on Site Customization Endpoint Enables Logo Overwrite via Base64 File Write
- CVE-2026-35179WWBN AVideo Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php
- CVE-2026-34740AVideo: Stored SSRF via Video EPG Link Missing isSSRFSafeURL() Validation
- CVE-2026-34739AVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.php
- CVE-2026-34738AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter
- CVE-2026-34737AVideo: Arbitrary Stripe Subscription Cancellation via Debug Endpoint and retrieveSubscriptions() Bug
- CVE-2026-34733AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard
- CVE-2026-34732AVideo: Missing Authentication in CreatePlugin list.json.php Template Affects 21 Endpoints
- CVE-2026-34731AVideo: Unauthenticated Live Stream Termination via RTMP Callback on_publish_done.php
- CVE-2026-34716AVideo: DOM XSS via Unsanitized Display Name in WebSocket Call Notification
- CVE-2026-34613AVideo: CSRF on Plugin Enable/Disable Endpoint Allows Disabling Security Plugins
- CVE-2026-34611AVideo: CSRF on emailAllUsers.json.php Enables Mass Phishing Email to All Users
- CVE-2026-34396AVideo: Stored XSS via Unescaped Plugin Configuration Values in Admin Panel
- CVE-2026-34394AVideo: CSRF on Admin Plugin Configuration Enables Payment Credential Hijacking
- CVE-2026-34395AVideo: Mass User PII Disclosure via Missing Authorization in YPTWallet users.json.php
- CVE-2026-34375AVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment Page
- CVE-2026-34374AVideo has SQL Injection in Live_schedule::keyExists() via Unparameterized Stream Key
- CVE-2026-34369AVIdeo has Video Password Protection Bypass via API Endpoints Returning Full Playback Sources Without Password Verification
- CVE-2026-34368AVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalance
- CVE-2026-34364AVideo has User Group-Based Category Access Control Bypass via Missing and Broken Group Filtering in categories.json.php
- CVE-2026-34362AVideo's WebSocket Token Never Expires Due to Commented-Out Timeout Validation in verifyTokenSocket()
- CVE-2026-34247AVideo's IDOR in uploadPoster.php Allows Any Authenticated User to Overwrite Scheduled Live Stream Posters and Trigger False Socket Notifications
- CVE-2026-34245AVideo's Missing Authorization in Playlist Schedule Creation Allows Cross-User Broadcast Hijacking
- CVE-2026-33867AVideo has Plaintext Video Password Storage
- CVE-2026-33770AVideo has SQL Injection in category.php fixCleanTitle() via Unparameterized clean_title and id Variables
- CVE-2026-33767AVideo has SQL Injection via Partial Prepared Statement — videos_id Concatenated Directly into Query
- CVE-2026-33766AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints
- CVE-2026-33764AVideo: IDOR in AI Plugin Allows Stealing Other Users' AI-Generated Metadata and Transcriptions
- CVE-2026-33763AVideo has an Unauthenticated Video Password Brute-Force Vulnerability via Unrate-Limited Boolean Oracle
- CVE-2026-33761AVideo: Unauthenticated Access to Scheduler Plugin Endpoints Leaks Scheduled Tasks, Email Content, and User Mappings