Vulnerabilities in WWBN

323 results
Vexday analysis

O portfólio de vulnerabilidades do WWBN reúne 187 CVEs catalogadas, com 30 classificadas como críticas e 67 surgidas apenas nos últimos 90 dias — volume recente que indica aceleração no ritmo de descoberta e demanda atenção contínua ao ciclo de atualização. Embora nenhuma CVE esteja no catálogo KEV da CISA, situando a taxa de exploração ativa abaixo da média geral do catálogo, o CVE-2022-30690 apresenta EPSS de 0,8358, sinalizando alta probabilidade estimada de exploração e devendo ser tratado com prioridade. A falha mais recorrente é CWE-79 (Cross-Site Scripting), categoria que, combinada com a existência de ao menos uma prova de conceito pública, amplia a superfície de risco para ambientes que ainda não aplicaram as correções disponíveis.

CVE-2026-43880MEDIUMWWBN AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Allows Phishing from Site's Legitimate From AddressEPSS 0.2%CVE-2026-92912HIGHAVideo Cryptographically Weak PRNG via uniqid Stream KeyEPSS 0.2%CVE-2026-34368MEDIUMAVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalanceEPSS 0.2%CVE-2026-43878MEDIUMWWBN AVideo: Reflected XSS in plugin/Meet/iframe.php via Unescaped `user`/`pass` Parameters Reflected into JavaScript String LiteralEPSS 0.2%CVE-2026-33723HIGHAVideo Vulnerable to SQL Injection in Subscribe Endpoint via Unsanitized user_id Parameter in subscribe.phpEPSS 0.2%CVE-2026-89247MEDIUMWWBN AVideo XML Injection via plugin/AD_Server/VMAP.phpEPSS 0.2%CVE-2026-88875MEDIUMAVideo Incomplete API Sanitization Information DisclosureEPSS 0.2%CVE-2026-34739MEDIUMAVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.phpEPSS 0.2%CVE-2026-86187HIGHWWBN AVideo Weak PRNG Password Generation via External LoginEPSS 0.2%CVE-2026-40935MEDIUMWWBN/AVideo has CAPTCHA Bypass via Attacker-Controlled Length Parameter and Missing Token Invalidation on FailureEPSS 0.2%CVE-2026-86729CRITICALWWBN AVideo Unrestricted Authentication Attempts via get_api_preauthorizeEPSS 0.2%CVE-2026-33500MEDIUMAVideo Vulnerable to Stored XSS via Markdown `javascript:` URI Bypasses ParsedownSafeWithLinks SanitizationEPSS 0.2%CVE-2026-34396MEDIUMAVideo: Stored XSS via Unescaped Plugin Configuration Values in Admin PanelEPSS 0.2%CVE-2026-33295HIGHAVideo Vulnerable to Stored XSS via Unescaped Video Title in CDN downloadButtons.phpEPSS 0.2%CVE-2026-41063MEDIUMWWBN AVideo has incomplete fix for CVE-2026-33500 (XSS)EPSS 0.2%CVE-2026-90546MEDIUMWWBN AVideo Missing Authorization via like.json.phpEPSS 0.2%CVE-2026-35179MEDIUMWWBN AVideo Unauthenticated Instagram Graph API Proxy via publishInstagram.json.phpEPSS 0.2%CVE-2026-90538MEDIUMWWBN AVideo Missing Authorization via playlistsFromUser.json.phpEPSS 0.2%CVE-2026-56380MEDIUMAVideo feed/index.php Exposure of Channel Owner Email AddressEPSS 0.2%CVE-2026-33764MEDIUMAVideo: IDOR in AI Plugin Allows Stealing Other Users' AI-Generated Metadata and TranscriptionsEPSS 0.2%