Read the docs

WWBN

Records365All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical59CVSS 9.0–10.0
CVSS high136CVSS 7.0–8.9

Exploited now

WWBN records in CISA KEV

No WWBN vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Avideo 190 records HIGH Avideo-encoder 3 records MEDIUM

Records

365 records

TI-2026-29567 CVE-2026-40911 · GHSA-gph2-j4c9-vhhr

Code injection in WWBN AVideo

Priority HIGH 82

WWBN AVideo is an open source video platform.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00645 Published 2026-04-21 No fix listed CWE-94
TI-2026-25874 CVE-2026-33478 · GHSA-687q-32c6-8x68

Improper access control in WWBN AVideo

Priority HIGH 82

WWBN AVideo is an open source video platform.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.13266 Published 2026-03-23 No fix listed CWE-284
TI-2026-58979 CVE-2026-86190 · GHSA-hr26-p4g3-798m

WWBN AVideo Broken Access Control via videoViewsInfo hash Parameter

Priority HIGH 81

WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery tokens, and live session identifiers to unauthenticated caller…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00444 Published 2026-09-05 No fix listed CWE-200
TI-2026-58487 CVE-2026-85154 · GHSA-c44x-r4cw-m5fr

WWBN AVideo Authentication Bypass via Non-Expiring video_id_hash

Priority HIGH 81

WWBN AVideo contains an authentication failure vulnerability where the video_id_hash credential is a non-expiring, non-revocable bearer token that grants full administrator session access to the video owner's account.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00642 Published 2026-09-03 No fix listed CWE-269
TI-2023-26562 CVE-2023-48728 · GHSA-wv3w-qq6q-g9j3

Cross-site scripting in WWBN AVideo

Priority HIGH 80

A cross-site scripting (xss) vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.6 and dev master commit 3c6bb3ff.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.02268 Published 2024-01-10 No fix listed CWE-79
TI-2026-58056 CVE-2026-84479 · GHSA-5vfg-9qx8-h8wf

WWBN AVideo Authentication Bypass via User-Agent Header

Priority HIGH 79

WWBN AVideo (current e01e41ecc and earlier) makes three login-time security controls depend solely on the client-supplied User-Agent header.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00549 Published 2026-09-01 No fix listed CWE-290
TI-2022-12691 CVE-2022-30534 · GHSA-f6mm-7v2x-hf2v

OS command injection in WWBN AVideo

Priority HIGH 79

An OS command injection vulnerability exists in the aVideoEncoder chunkfile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.74979 Published 2022-08-22 No fix listed CWE-78
TI-2022-12703 CVE-2022-30547 · GHSA-hf7w-vjx3-6xj6

Path traversal in WWBN AVideo

Priority HIGH 78

A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.63666 Published 2022-08-22 No fix listed CWE-22
TI-2026-62100 CVE-2026-91965 · GHSA-cgc3-3gxq-qpxj

WWBN AVideo through 29.0 Broken Access Control via Live Endpoints

Priority HIGH 77

WWBN AVideo through 29.0 fails to enforce user-group restrictions in the plugin/Live/stats.json.php and plugin/Live/calendar.json.php endpoints.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00451 Published 2026-09-15 No fix listed CWE-200
TI-2026-61551 CVE-2026-90537 · GHSA-7cf9-xwv8-6722

WWBN AVideo Scheduler sendEmail Missing Authorization via Token

Priority HIGH 77

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/Scheduler/sendEmail.json.php that allows unauthenticated attackers to access scheduler email jo…

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.0036 Published 2026-09-12 No fix listed CWE-862
TI-2026-60424 CVE-2026-89250 · GHSA-hrf3-w8h6-mf5c

WWBN AVideo Unauthenticated File Read via getRecordedFile.php

Priority HIGH 77

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an unauthenticated file read vulnerability in the getRecordedFile.php endpoint that streams recorded FLV files from the temporary directory.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00504 Published 2026-09-11 No fix listed CWE-306
TI-2026-60260 CVE-2026-88876 · GHSA-86jv-34hw-c5j7

AVideo PlayerSkins seo.php Missing Authorization Password-Protected VOD

Priority HIGH 77

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/PlayerSkins/seo.php that allows unauthenticated attackers to access password-protected video sourc…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00438 Published 2026-09-10 No fix listed CWE-200
Load more
Open these records in search →