WWBN vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-61572 AVideo is a video-sharing Platform.High 8.6 · Oct 28, 2026
• CVE-2026-61571 AVideo is a video-sharing Platform.High 7.3 · Oct 28, 2026
• CVE-2026-61569 AVideo is a video-sharing Platform.High 7.5 · Oct 28, 2026
• CVE-2026-61567 AVideo is a video-sharing Platform.Critical 10 · Oct 28, 2026
• CVE-2026-61564 AVideo is a video-sharing Platform.Critical 10 · Oct 28, 2026
• CVE-2026-114633 WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts to delete or modify administrator accountHigh 7 · Oct 21, 2026
• CVE-2026-105089 WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a maliciousCritical 9.3 · Oct 4, 2026
• CVE-2026-105086 WWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows authenticated uploaders to inject HTML by submitting doubly-encCritical 9.3 · Oct 4, 2026
• CVE-2026-92914 AVideo LoginControl contains an authentication bypass vulnerability in the PGP second factor verification that compares challenge responses using loose equalityHigh 8.6 · Sep 17, 2026
• CVE-2026-92913 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 uses a cryptographically weak pseudo-random number generator when creating account activation / lCritical 9.1 · Sep 17, 2026
• CVE-2026-92912 AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 uses cryptographically weak uniqid() values for RTMP publish keys in LiveTransmition, reducing key entroHigh 8.3 · Sep 17, 2026
• CVE-2026-92582 AVideo (WWBN/AVideo) through 29.0 (commit e01e41ecc) is vulnerable to cross-site request forgery.High 7.1 · Sep 16, 2026
• CVE-2026-92580 In AVideo through 29.0, the CloneSite plugin is vulnerable to stored OS command injection.High 8.7 · Sep 16, 2026
• CVE-2026-92578 WWBN AVideo through 29.0 contains an authentication bypass vulnerability where the stored password hash is accepted as a valid login credential through two indeCritical 9.2 · Sep 16, 2026
• CVE-2026-92577 In AVideo through 29.0, the API get_api_video endpoint contains a broken access control vulnerability in the clean_title branch that returns user-group-restrictHigh 8.7 · Sep 16, 2026
• CVE-2026-91965 WWBN AVideo through 29.0 fails to enforce user-group restrictions in the plugin/Live/stats.json.php and plugin/Live/calendar.json.php endpoints.High 8.7 · Sep 15, 2026
• CVE-2026-90537 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/Scheduler/sendEmail.json.php that aHigh 8.8 · Sep 12, 2026
• CVE-2026-89256 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the Bookmark plugin where chapter names aCritical 9.3 · Sep 11, 2026
• CVE-2026-89255 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to HTMCritical 9.3 · Sep 11, 2026
• CVE-2026-89254 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the CustomizeUser plugin where the field_Critical 9.3 · Sep 11, 2026
• CVE-2026-89253 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the user 'donationLink' profile fielCritical 9.3 · Sep 11, 2026
• CVE-2026-89252 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify ownership in addLiveLink.php when updating LiveLinks, allowing authenticated userHigh 7.1 · Sep 11, 2026
• CVE-2026-89251 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ad impressions in plugin/AD_Server/log.php, allowing logged-in users to submit High 7.1 · Sep 11, 2026
• CVE-2026-89250 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an unauthenticated file read vulnerability in the getRecordedFile.php endpoint thatHigh 8.7 · Sep 11, 2026
• CVE-2026-89249 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the YPTWallet plugin where user-supplied Critical 9.3 · Sep 11, 2026