Vulnerabilities in WWBN

323 results
Vexday analysis

O portfólio de vulnerabilidades do WWBN reúne 187 CVEs catalogadas, com 30 classificadas como críticas e 67 surgidas apenas nos últimos 90 dias — volume recente que indica aceleração no ritmo de descoberta e demanda atenção contínua ao ciclo de atualização. Embora nenhuma CVE esteja no catálogo KEV da CISA, situando a taxa de exploração ativa abaixo da média geral do catálogo, o CVE-2022-30690 apresenta EPSS de 0,8358, sinalizando alta probabilidade estimada de exploração e devendo ser tratado com prioridade. A falha mais recorrente é CWE-79 (Cross-Site Scripting), categoria que, combinada com a existência de ao menos uma prova de conceito pública, amplia a superfície de risco para ambientes que ainda não aplicaram as correções disponíveis.

CVE-2026-86720HIGHWWBN AVideo Missing Authorization via resendRestreamer.json.phpEPSS 0.3%CVE-2026-82644HIGHWWBN AVideo Brute-force Rate Limiting Bypass via Missing User-AgentEPSS 0.3%CVE-2026-84481MEDIUMWWBN AVideo through 30.0 Information Disclosure via MobileManagerEPSS 0.3%CVE-2026-56347MEDIUMAVideo TopMenu Plugin - Stored Cross-Site Scripting via Unescaped Menu Item FieldsEPSS 0.3%CVE-2026-86726HIGHAVideo through 29.0 Information Disclosure via restreamsActive.json.phpEPSS 0.3%CVE-2026-84476HIGHWWBN AVideo Authentication Bypass via X-Real-IP HeaderEPSS 0.3%CVE-2026-72747MEDIUMAVideo Stored Cross-Site Scripting via Unauthenticated RegistrationEPSS 0.3%CVE-2026-88865HIGHAVideo Missing Authorization via getRestream.json.phpEPSS 0.3%CVE-2026-85577MEDIUMAVideo userLogin.php Reflected XSS via error parameterEPSS 0.3%CVE-2026-43885HIGHWWBN AVideo: Exposure of Sensitive Information to an Unauthorized Actor and Missing AuthorizationEPSS 0.3%CVE-2026-92577HIGHAVideo through 29.0 API get_api_video Broken Access Control via clean_titleEPSS 0.3%CVE-2026-50183MEDIUMWWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery SectionEPSS 0.3%CVE-2026-88868CRITICALAVideo LiveLinks Stored XSS via title and description fieldsEPSS 0.3%CVE-2026-43873HIGHWWBN AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone ServerEPSS 0.3%CVE-2026-33354HIGHAVideo has an authenticated arbitrary local file read via `chunkFile` path injection in `aVideoEncoder.json.php`EPSS 0.3%CVE-2026-86188MEDIUMAVideo YPTSocket Plugin Unauthenticated Cross-Site ScriptingEPSS 0.3%CVE-2026-43874HIGHWWBN AVideo: Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']` Relay BypassEPSS 0.3%CVE-2026-33488HIGHAVideo has a PGP 2FA Bypass via Cryptographically Broken 512-bit RSA Key Generation in LoginControl PluginEPSS 0.3%CVE-2026-40908MEDIUMWWBN AVideo has an Unauthenticated Information Disclosure via git.json.php that Exposes Developer Emails and Deployed VersionEPSS 0.3%CVE-2026-34245MEDIUMAVideo's Missing Authorization in Playlist Schedule Creation Allows Cross-User Broadcast HijackingEPSS 0.2%