Vulnerabilities in WWBN
339 resultsCVE-2026-33480HIGHAVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks ProxyEPSS 0.3%CVE-2026-43873HIGHWWBN AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone ServerEPSS 0.3%CVE-2026-33685MEDIUMAVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User DataEPSS 0.3%CVE-2026-43881MEDIUMWWBN AVideo: Unauthenticated User Enumeration in `objects/users.json.php` via `isCompany` Parameter Flips `$ignoreAdmin = true` and Defeats Admin-Only Listing GuardEPSS 0.3%CVE-2026-45578HIGHWWBN AVideo Live: OS command injection in on_publish.php execAsync via unescaped m3u8 URLEPSS 0.3%CVE-2026-82648HIGHWWBN AVideo SSRF Filter Bypass via NAT64 Hex AddressEPSS 0.3%CVE-2026-89240MEDIUMWWBN AVideo Reflected XSS via confirmLivePassword.phpEPSS 0.3%CVE-2026-89252HIGHAVideo Missing Authorization in addLiveLink.php LiveLink UpdateEPSS 0.3%CVE-2026-88875MEDIUMAVideo Incomplete API Sanitization Information DisclosureEPSS 0.3%CVE-2026-33759MEDIUMAVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist ContentsEPSS 0.3%CVE-2026-92912HIGHAVideo Cryptographically Weak PRNG via uniqid Stream KeyEPSS 0.3%CVE-2026-33492HIGHAVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session RegenerationEPSS 0.3%CVE-2026-34375HIGHAVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment PageEPSS 0.3%CVE-2026-41060HIGHAVideo's SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURLEPSS 0.3%CVE-2026-92583MEDIUMAVideo through 29.0 Rate Limit Bypass via Non-Atomic Counter IncrementEPSS 0.3%CVE-2026-86186MEDIUMAVideo API Rate Limit Bypass via Bot User-Agent HeaderEPSS 0.3%CVE-2026-89257MEDIUMAVideo through 29.0 Cross-User Category Asset Deletion via Missing Ownership CheckEPSS 0.3%CVE-2026-90545MEDIUMWWBN AVideo Missing Authorization via commentAddNew.json.phpEPSS 0.3%CVE-2026-43874HIGHWWBN AVideo: Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']` Relay BypassEPSS 0.3%CVE-2026-84477MEDIUMAVideo Stored XSS via Live Schedule Title DescriptionEPSS 0.3%