Wwbn
Page 2 of 2 — Wwbn CVEs from a corpus of 186, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-33716 | Critical | 9.4 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the standalone live stream control endpoint at `plugin/Live/standAloneFiles… |
CVE-2026-33690 | Medium | 5.3 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `getRealIpAddr()` function in `objects/functions.php` trusts user-contr… |
CVE-2026-33688 | Medium | 5.3 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the password recovery endpoint at `objects/userRecoverPass.php` performs us… |
CVE-2026-33685 | Medium | 5.3 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `plugin/AD_Server/reports.json.php` endpoint performs no authentication… |
CVE-2026-33683 | Medium | 5.4 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, a sanitization order-of-operations flaw in the user profile "about" field a… |
CVE-2026-33681 | High | 7.2 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/pluginRunDatabaseScript.json.php` endpoint accepts a `name` pa… |
CVE-2026-33651 | High | 8.1 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `remindMe.json.php` endpoint passes `$_REQUEST['live_schedule_id']` thr… |
CVE-2026-33650 | High | 7.6 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, a user with the "Videos Moderator" permission can escalate privileges to pe… |
CVE-2026-33649 | High | 8.1 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `plugin/Permissions/setPermission.json.php` endpoint accepts GET parame… |
CVE-2026-33648 | High | 8.8 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the restreamer endpoint constructs a log file path by embedding user-contro… |
CVE-2026-33647 | High | 8.8 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `ImageGallery::saveFile()` method validates uploaded file content using… |
CVE-2026-33513 | High | 8.6 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, an unauthenticated API endpoint (`APIName=locale`) concatenates user input… |
CVE-2026-33512 | High | 7.5 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the API plugin exposes a `decryptString` action without any authentication… |
CVE-2026-33507 | High | 8.8 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/pluginImport.json.php` endpoint allows admin users to upload a… |
CVE-2026-33502 | Critical | 9.3 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, an unauthenticated server-side request forgery vulnerability in `plugin/Liv… |
CVE-2026-33501 | Medium | 5.3 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the endpoint `plugin/Permissions/View/Users_groups_permissions/list.json.ph… |
CVE-2026-33500 | Medium | 5.4 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the fix for CVE-2026-27568 (GHSA-rcqw-6466-3mv7) introduced a custom `Parse… |
CVE-2026-33499 | Medium | 6.1 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `view/forbiddenPage.php` and `view/warningPage.php` templates reflect t… |
CVE-2026-33493 | High | 7.1 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/import.json.php` endpoint accepts a user-controlled `fileURI`… |
CVE-2026-33492 | High | 7.3 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, AVideo's `_session_start()` function accepts arbitrary session IDs via the… |
CVE-2026-33488 | High | 7.4 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `createKeys()` function in the LoginControl plugin's PGP 2FA system gen… |
CVE-2026-33485 | High | 7.5 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the RTMP `on_publish` callback at `plugin/Live/on_publish.php` is accessibl… |
CVE-2026-33483 | High | 7.5 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `aVideoEncoderChunk.json.php` endpoint is a completely standalone PHP s… |
CVE-2026-33482 | High | 8.1 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `sanitizeFFmpegCommand()` function in `plugin/API/standAlone/functions… |
CVE-2026-33480 | High | 8.6 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `isSSRFSafeURL()` function in AVideo can be bypassed using IPv4-mapped… |
CVE-2026-33479 | High | 8.8 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the Gallery plugin's `saveSort.json.php` endpoint passes unsanitized user i… |
CVE-2026-33478 | Critical | 10.0 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, multiple vulnerabilities in AVideo's CloneSite plugin chain together to all… |
CVE-2026-33354 | High | 7.6 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, `POST /objects/aVideoEncoder.json.php` accepts a requester-controlled `chun… |
CVE-2026-33352 | Critical | 9.8 | 2026-03-23 | WWBN AVideo is an open source video platform. Prior to version 26.0, an unauthenticated SQL injection vulnerability exists in `objects/category.php` in the `ge… |
CVE-2026-33351 | Critical | 9.1 | 2026-03-23 | WWBN AVideo is an open source video platform. Prior to version 26.0, a Server-Side Request Forgery (SSRF) vulnerability exists in `plugin/Live/standAloneFiles/… |
CVE-2026-33297 | Critical | 9.1 | 2026-03-23 | WWBN AVideo is an open source video platform. Prior to version 26.0, the `setPassword.json.php` endpoint in the CustomizeUser plugin allows administrators to s… |
CVE-2026-33319 | Medium | 5.9 | 2026-03-22 | WWBN AVideo is an open source video platform. Prior to version 26.0, the `uploadVideoToLinkedIn()` method in the SocialMediaPublisher plugin constructs a shell… |
CVE-2026-33296 | Medium | 6.1 | 2026-03-22 | WWBN AVideo is an open source video platform. Prior to version 26.0, WWBN/AVideo contains an open redirect vulnerability in the login flow where a user-supplie… |
CVE-2026-33295 | Medium | 5.4 | 2026-03-22 | WWBN AVideo is an open source video platform. Prior to version 26.0, WWBN/AVideo contains a stored cross-site scripting vulnerability in the CDN plugin's downl… |
CVE-2026-33294 | Medium | 5.0 | 2026-03-22 | WWBN AVideo is an open source video platform. Prior to version 26.0, the BulkEmbed plugin's save endpoint (`plugin/BulkEmbed/save.json.php`) fetches user-suppl… |
CVE-2026-33293 | High | 8.1 | 2026-03-22 | WWBN AVideo is an open source video platform. Prior to version 26.0, the `deleteDump` parameter in `plugin/CloneSite/cloneServer.json.php` is passed directly t… |
CVE-2026-33292 | High | 7.5 | 2026-03-22 | WWBN AVideo is an open source video platform. Prior to version 26.0, the HLS streaming endpoint (`view/hls.php`) is vulnerable to a path traversal attack that… |
CVE-2026-33238 | Medium | 4.3 | 2026-03-21 | WWBN AVideo is an open source video platform. Prior to version 26.0, the `listFiles.json.php` endpoint accepts a `path` POST parameter and passes it directly t… |
CVE-2026-33237 | Medium | 5.5 | 2026-03-21 | WWBN AVideo is an open source video platform. Prior to version 26.0, the Scheduler plugin's `run()` function in `plugin/Scheduler/Scheduler.php` calls `url_get… |
CVE-2026-33043 | High | 8.1 | 2026-03-20 | WWBN AVideo is an open source video platform. In versions 25.0 and below, /objects/phpsessionid.json.php exposes the current PHP session ID to any unauthentica… |
CVE-2026-33041 | Medium | 5.3 | 2026-03-20 | WWBN AVideo is an open source video platform. In versions 25.0 and below, /objects/encryptPass.json.php exposes the application's password hashing algorithm to… |
CVE-2026-33039 | High | 8.6 | 2026-03-20 | WWBN AVideo is an open source video platform. In versions 25.0 and below, the plugin/LiveLinks/proxy.php endpoint validates user-supplied URLs against internal… |
CVE-2026-33038 | High | 8.1 | 2026-03-20 | WWBN AVideo is an open source video platform. Versions 25.0 and below are vulnerable to unauthenticated application takeover through the install/checkConfigura… |
CVE-2026-33037 | High | 8.1 | 2026-03-20 | WWBN AVideo is an open source video platform. In versions 25.0 and below, the official Docker deployment files (docker-compose.yml, env.example) ship with the… |
CVE-2026-33035 | Medium | 6.1 | 2026-03-20 | WWBN AVideo is an open source video platform. In versions 25.0 and below, there is a reflected XSS vulnerability that allows unauthenticated attackers to execu… |
CVE-2026-33025 | High | 8.8 | 2026-03-20 | AVideo is a video-sharing Platform. Versions prior to 8.0 contain a SQL Injection vulnerability in the getSqlFromPost() method of Object.php. The $_POST['sort'… |
CVE-2026-33024 | Critical | 9.1 | 2026-03-20 | AVideo is a video-sharing Platform. Versions prior to 8.0 contain a Server-Side Request Forgery vulnerability (CWE-918) in the public thumbnail endpoints getIm… |
CVE-2026-30885 | Medium | 5.3 | 2026-03-10 | WWBN AVideo is an open source video platform. Prior to 25.0, the /objects/playlistsFromUser.json.php endpoint returns all playlists for any user without requir… |
CVE-2026-29058 | Critical | 9.8 | 2026-03-06 | AVideo is a video-sharing Platform software. Prior to version 7.0, an unauthenticated attacker can execute arbitrary OS commands on the server by injecting she… |
CVE-2026-29093 | High | 8.1 | 2026-03-06 | WWBN AVideo is an open source video platform. Prior to version 24.0, the official docker-compose.yml publishes the memcached service on host port 11211 (0.0.0… |
CVE-2026-28502 | High | 8.8 | 2026-03-06 | WWBN AVideo is an open source video platform. Prior to version 24.0, an authenticated Remote Code Execution (RCE) vulnerability was identified in AVideo relate… |
CVE-2026-28501 | Critical | 9.8 | 2026-03-06 | WWBN AVideo is an open source video platform. Prior to version 24.0, an unauthenticated SQL Injection vulnerability exists in AVideo within the objects/videos… |
CVE-2026-27732 | High | 8.1 | 2026-02-24 | WWBN AVideo is an open source video platform. Prior to version 22.0, the `aVideoEncoder.json.php` API endpoint accepts a `downloadURL` parameter and fetches th… |
CVE-2026-27568 | Medium | 6.1 | 2026-02-24 | WWBN AVideo is an open source video platform. Prior to version 21.0, AVideo allows Markdown in video comments and uses Parsedown (v1.7.4) without Safe Mode ena… |
CVE-2020-37173 | High | 7.5 | 2026-02-11 | AVideo Platform 8.1 contains an information disclosure vulnerability that allows attackers to enumerate user details through the playlistsFromUser.json.php end… |
CVE-2020-37172 | Medium | 5.3 | 2026-02-11 | AVideo Platform 8.1 contains a cross-site request forgery vulnerability that allows attackers to reset user passwords by exploiting the password recovery mecha… |
CVE-2020-37158 | Medium | 5.3 | 2026-02-11 | AVideo Platform 8.1 contains a cross-site request forgery vulnerability that allows attackers to reset user passwords by exploiting the password recovery mecha… |
CVE-2025-34442 | High | 7.5 | 2025-12-17 | AVideo versions prior to 20.1 disclose absolute filesystem paths via multiple public API endpoints. Returned metadata includes full server paths to media files… |
CVE-2025-34441 | High | 7.5 | 2025-12-17 | AVideo versions prior to 20.1 expose sensitive user information through an unauthenticated public API endpoint. Responses include emails, usernames, administra… |
CVE-2025-34440 | Medium | 6.1 | 2025-12-17 | AVideo versions prior to 20.1 contain an open redirect vulnerability caused by insufficient validation of the siteRedirectUri parameter during user registratio… |
CVE-2025-34439 | Medium | 6.1 | 2025-12-17 | AVideo versions prior to 20.1 are vulnerable to an open redirect flaw due to missing validation of the cancelUri parameter during user login. An attacker can c… |
CVE-2025-34438 | High | 8.1 | 2025-12-17 | AVideo versions prior to 20.1 contain an insecure direct object reference vulnerability allowing users with upload permissions to modify the rotation metadata… |
CVE-2025-34437 | High | 8.8 | 2025-12-17 | AVideo versions prior to 20.1 permit any authenticated user to upload comment images to videos owned by other users. The endpoint validates authentication but… |
CVE-2025-34436 | High | 8.8 | 2025-12-17 | AVideo versions prior to 20.1 allow any authenticated user to upload files into directories belonging to other users due to an insecure direct object reference… |
CVE-2025-34435 | Medium | 6.5 | 2025-12-17 | AVideo versions prior to 20.1 are vulnerable to an insecure direct object reference (IDOR) that allows any authenticated user to delete media files belonging t… |
CVE-2025-34434 | Critical | 9.1 | 2025-12-17 | AVideo versions prior to 20.1 with the ImageGallery plugin enabled is vulnerable to unauthenticated file upload and deletion. Plugin endpoints responsible for… |
CVE-2025-53084 | Critical | 9.0 | 2025-07-24 | A cross-site scripting (xss) vulnerability exists in the videosList page parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A speciall… |
CVE-2025-50128 | Critical | 9.6 | 2025-07-24 | A cross-site scripting (xss) vulnerability exists in the videoNotFound 404ErrorMsg parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff… |
CVE-2025-48732 | High | 7.3 | 2025-07-24 | An incomplete blacklist exists in the .htaccess sample of WWBN AVideo 14.4 and dev master commit 8a8954ff. A specially crafted HTTP request can lead to a arbit… |
CVE-2025-46410 | Critical | 9.6 | 2025-07-24 | A cross-site scripting (xss) vulnerability exists in the managerPlaylists PlaylistOwnerUsersId parameter functionality of WWBN AVideo 14.4 and dev master commi… |
CVE-2025-41420 | Critical | 9.6 | 2025-07-24 | A cross-site scripting (xss) vulnerability exists in the userLogin cancelUri parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A spec… |
CVE-2025-36548 | High | 8.3 | 2025-07-24 | A cross-site scripting (xss) vulnerability exists in the LoginWordPress loginForm cancelUri parameter functionality of WWBN AVideo 14.4 and dev master commit 8… |
CVE-2025-25214 | High | 8.8 | 2025-07-24 | A race condition vulnerability exists in the aVideoEncoder.json.php unzip functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A series of special… |
CVE-2024-34899 | Medium | 5.4 | 2024-05-14 | WWBN AVideo 12.4 is vulnerable to Cross Site Scripting (XSS). |
CVE-2024-31819 | Critical | 9.8 | 2024-04-10 | An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath parameter of the submitIndex.php compon… |
CVE-2023-50172 | Medium | 5.3 | 2024-01-10 | A recovery notification bypass vulnerability exists in the userRecoverPass.php captcha validation functionality of WWBN AVideo dev master commit 15fed957fb. A… |
CVE-2023-49864 | Medium | 6.5 | 2024-01-10 | An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb… |
CVE-2023-49863 | Medium | 6.5 | 2024-01-10 | An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb… |
CVE-2023-49862 | Medium | 6.5 | 2024-01-10 | An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb… |
CVE-2023-49810 | High | 7.3 | 2024-01-10 | A login attempt restriction bypass vulnerability exists in the checkLoginAttempts functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafte… |
CVE-2023-49738 | High | 7.5 | 2024-01-10 | An information disclosure vulnerability exists in the image404Raw.php functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP reque… |
CVE-2023-49715 | Medium | 4.3 | 2024-01-10 | A unrestricted php file upload vulnerability exists in the import.json.php temporary copy functionality of WWBN AVideo dev master commit 15fed957fb. A speciall… |
CVE-2023-49599 | Critical | 9.8 | 2024-01-10 | An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted series of HT… |
CVE-2023-49589 | High | 8.8 | 2024-01-10 | An insufficient entropy vulnerability exists in the userRecoverPass.php recoverPass generation functionality of WWBN AVideo dev master commit 15fed957fb. A spe… |
CVE-2023-48730 | High | 8.5 | 2024-01-10 | A cross-site scripting (xss) vulnerability exists in the navbarMenuAndLogo.php user name functionality of WWBN AVideo dev master commit 15fed957fb. A specially… |
CVE-2023-48728 | Critical | 9.6 | 2024-01-10 | A cross-site scripting (xss) vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.6 and dev master commit 3c6bb3ff. A spe… |
CVE-2023-47862 | Critical | 9.8 | 2024-01-10 | A local file inclusion vulnerability exists in the getLanguageFromBrowser functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP r… |
CVE-2023-47861 | Critical | 9.0 | 2024-01-10 | A cross-site scripting (xss) vulnerability exists in the channelBody.php user name functionality of WWBN AVideo 11.6 and dev master commit 15fed957fb. A specia… |
CVE-2023-47171 | Medium | 6.5 | 2024-01-10 | An information disclosure vulnerability exists in the aVideoEncoder.json.php chunkFile path functionality of WWBN AVideo 11.6 and dev master commit 15fed957fb… |
CVE-2023-32073 | High | 8.8 | 2023-05-12 | WWBN AVideo is an open source video platform. In versions 12.4 and prior, a command injection vulnerability exists at `plugin/CloneSite/cloneClient.json.php` w… |
CVE-2023-30860 | High | 8.0 | 2023-05-08 | WWBN AVideo is an open source video platform. In AVideo prior to version 12.4, a normal user can make a Meeting Schedule where the user can invite another user… |
CVE-2023-30854 | High | 8.8 | 2023-04-28 | AVideo is an open source video platform. Prior to version 12.4, an OS Command Injection vulnerability in an authenticated endpoint `/plugin/CloneSite/cloneClie… |
CVE-2023-25314 | Medium | 6.1 | 2023-04-25 | Cross Site Scripting (XSS) vulnerability in World Wide Broadcast Network AVideo before 12.4, allows attackers to gain sensitive information via the success par… |
CVE-2023-25313 | Critical | 9.8 | 2023-04-25 | OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbitrary code via the video link field to t… |
CVE-2022-34652 | High | 8.8 | 2022-08-22 | A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can le… |
CVE-2022-33149 | High | 8.8 | 2022-08-22 | A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can le… |
CVE-2022-33148 | High | 8.8 | 2022-08-22 | A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can le… |
CVE-2022-33147 | High | 8.8 | 2022-08-22 | A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can le… |
CVE-2022-32778 | High | 7.5 | 2022-08-22 | An information disclosure vulnerability exists in the cookie functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. The session cookie and the pass… |
CVE-2022-32777 | High | 7.5 | 2022-08-22 | An information disclosure vulnerability exists in the cookie functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. The session cookie and the pass… |