Vulnerabilities in WWBN
339 resultsCVE-2026-33295HIGHAVideo Vulnerable to Stored XSS via Unescaped Video Title in CDN downloadButtons.phpEPSS 0.2%CVE-2026-39368MEDIUMWWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal servicesEPSS 0.2%CVE-2026-40935MEDIUMWWBN/AVideo has CAPTCHA Bypass via Attacker-Controlled Length Parameter and Missing Token Invalidation on FailureEPSS 0.2%CVE-2026-41063MEDIUMWWBN AVideo has incomplete fix for CVE-2026-33500 (XSS)EPSS 0.2%CVE-2026-43882MEDIUMWWBN AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event SpoofingEPSS 0.2%CVE-2026-39370HIGHWWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration (Incomplete fix for CVE-2026-27732)EPSS 0.2%CVE-2026-84482HIGHWWBN AVideo Cross-Site Request Forgery via get_domain() validationEPSS 0.2%CVE-2026-34613MEDIUMAVideo: CSRF on Plugin Enable/Disable Endpoint Allows Disabling Security PluginsEPSS 0.2%CVE-2026-39367MEDIUMWWBN AVideo has Stored XSS via Malicious EPG XML Program Titles in AVideo EPG PageEPSS 0.2%CVE-2026-56347MEDIUMAVideo TopMenu Plugin - Stored Cross-Site Scripting via Unescaped Menu Item FieldsEPSS 0.2%CVE-2026-43883MEDIUMWWBN AVideo: IDOR in PayPalYPT agreementCancel.json.php Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription AgreementsEPSS 0.2%CVE-2026-50183MEDIUMWWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery SectionEPSS 0.2%CVE-2026-43879MEDIUMWWBN AVideo: Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT_FOLLOWLOCATION Redirect BypassEPSS 0.2%CVE-2026-86718HIGHWWBN AVideo Cross-Site Request Forgery via deleteHistory.json.phpEPSS 0.2%CVE-2026-82645CRITICALAVideo Unauthenticated Stream Credential Disclosure via Forgeable TokenEPSS 0.2%CVE-2026-45620MEDIUMAVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumerationEPSS 0.2%CVE-2026-33296LOWAVideo has an Open Redirect via Unvalidated redirectUri in userLogin.phpEPSS 0.2%CVE-2026-43876MEDIUMWWBN AVideo: HTML Injection in notifySubscribers.json.php Enables Platform-Branded Phishing Emails to Channel SubscribersEPSS 0.2%CVE-2026-88872HIGHAVideo CustomizeUser setPassword.json.php CSRFEPSS 0.2%CVE-2026-89251HIGHAVideo Missing Authorization via AD_Server log.php Wallet CreditEPSS 0.2%