Wwbn vulnerabilities
345 CVEs and advisories name Wwbn as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-33759AVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist Contents
- CVE-2026-33723AVideo Vulnerable to SQL Injection in Subscribe Endpoint via Unsanitized user_id Parameter in subscribe.php
- CVE-2026-33719AVideo Vulnerable to Unauthenticated CDN Configuration Takeover via Empty Default Key Bypass and Mass-Assignment in status.json.php
- CVE-2026-33717AVideo Vulnerable to Remote Code Execution via Persistent PHP Temp File in Encoder downloadURL with Resolution Validation Abort
- CVE-2026-33716AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php
- CVE-2026-33690AVideo vulnerable to IP Address Spoofing via Untrusted HTTP Headers in getRealIpAddr()
- CVE-2026-33688AVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery Endpoint
- CVE-2026-33685AVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User Data
- CVE-2026-33683AVideo vulnerable to Stored XSS via html_entity_decode() Reversing xss_esc() Sanitization in Channel About Field
- CVE-2026-33681AVideo has Path Traversal in pluginRunDatabaseScript.json.php Enables Arbitrary SQL File Execution via Unsanitized Plugin Name
- CVE-2026-33651AVideo has a Blind SQL Injection in Live Schedule Reminder via Unsanitized live_schedule_id in Scheduler_commands::getAllActiveOrToRepeat()
- CVE-2026-33650AVideo's Video Moderator Privilege Escalation via Ownership Transfer Enables Arbitrary Video Deletion
- CVE-2026-33649AVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission Modification
- CVE-2026-33648AVideo Vulnerable to OS Command Injection via Unsanitized `users_id` and `liveTransmitionHistory_id` in Restreamer Log File Path
- CVE-2026-33647AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload
- CVE-2026-33513AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP)
- CVE-2026-33512AVideo has an unauthenticated decrypt oracle leaking any ciphertext
- CVE-2026-33507AVideo Affected by CSRF on Plugin Import Endpoint Enables Unauthenticated Remote Code Execution via Malicious Plugin Upload
- CVE-2026-33502AVideo has Unauthenticated SSRF via plugin/Live/test.php
- CVE-2026-33501AVideo has Unauthenticated Information Disclosure of User Group Permission Mappings via Permissions Plugin
- CVE-2026-33500AVideo Vulnerable to Stored XSS via Markdown `javascript:` URI Bypasses ParsedownSafeWithLinks Sanitization
- CVE-2026-33499AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php
- CVE-2026-33493AVideo has a Path Traversal in import.json.php that Allows Private Video Theft and Arbitrary File Read/Deletion via fileURI Parameter
- CVE-2026-33492AVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session Regeneration
- CVE-2026-33488AVideo has a PGP 2FA Bypass via Cryptographically Broken 512-bit RSA Key Generation in LoginControl Plugin
- CVE-2026-33485AVideo has an Unauthenticated Blind SQL Injection in RTMP on_publish Callback via Stream Name Parameter
- CVE-2026-33483AVideo Affected by Unauthenticated Disk Space Exhaustion via Unlimited Temp File Creation in aVideoEncoderChunk.json.php
- CVE-2026-33482AVideo has an OS Command Injection via $() Shell Substitution Bypass in sanitizeFFmpegCommand()
- CVE-2026-33480AVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks Proxy
- CVE-2026-33479AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin