Vulnerabilities in WWBN

323 results
Vexday analysis

O portfólio de vulnerabilidades do WWBN reúne 187 CVEs catalogadas, com 30 classificadas como críticas e 67 surgidas apenas nos últimos 90 dias — volume recente que indica aceleração no ritmo de descoberta e demanda atenção contínua ao ciclo de atualização. Embora nenhuma CVE esteja no catálogo KEV da CISA, situando a taxa de exploração ativa abaixo da média geral do catálogo, o CVE-2022-30690 apresenta EPSS de 0,8358, sinalizando alta probabilidade estimada de exploração e devendo ser tratado com prioridade. A falha mais recorrente é CWE-79 (Cross-Site Scripting), categoria que, combinada com a existência de ao menos uma prova de conceito pública, amplia a superfície de risco para ambientes que ainda não aplicaram as correções disponíveis.

CVE-2026-88871MEDIUMWWBN AVideo CustomizeUser setSubscribers CSRF via GETEPSS 0.1%CVE-2026-45580MEDIUMWWBN AVideo Live: stored XSS via unescaped stream key in modeYoutubeLive.php class attributeEPSS 0.1%CVE-2026-88873HIGHWWBN AVideo Cross-Site Request Forgery via logArchive.json.phpEPSS 0.1%CVE-2026-45619MEDIUMAVideo CVE-2026-43884 incomplete fix - `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD postEPSS 0.1%CVE-2026-35181MEDIUMWWBN AVideo Affected by CSRF on Player Skin Configuration via admin/playerUpdate.json.phpEPSS 0.1%CVE-2026-41057HIGHAVideo has CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) that Exposes Authenticated API ResponsesEPSS 0.1%CVE-2026-82645CRITICALAVideo Unauthenticated Stream Credential Disclosure via Forgeable TokenEPSS 0.1%CVE-2026-86724HIGHAVideo YPTWallet saveBalance.php Cross-Site Request ForgeryEPSS 0.1%CVE-2026-88870HIGHWWBN AVideo LoginControl PGP Key CSRF via GET RequestEPSS 0.1%CVE-2026-92582HIGHAVideo through 29.0 Broken Access Control via videoAddNew.json.php CSRF BypassEPSS 0.1%CVE-2026-43877MEDIUMWWBN AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Any Logged-in User's Profile Photo with Arbitrary BytesEPSS 0.1%CVE-2026-47696HIGHWWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpointEPSS 0.1%CVE-2026-85162HIGHAVideo through c91b5975d CSRF via saveLive.phpEPSS 0.1%CVE-2026-40928MEDIUMAVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset DeletionEPSS 0.1%CVE-2026-40929MEDIUMWWBN AVideo's missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creatorsEPSS 0.1%CVE-2026-58003HIGHWWBN AVideo Cross-Site Request Forgery via releaseVideoNow.json.phpEPSS 0.1%CVE-2026-35180MEDIUMWWBN AVideo affected by CSRF on Site Customization Endpoint Enables Logo Overwrite via Base64 File WriteEPSS 0.1%CVE-2026-58001MEDIUMWWBN AVideo Cross-Site Request Forgery via videoEditLight.phpEPSS 0.1%CVE-2026-45610MEDIUMWWBN AVideo plugin/LoginControl/set.json.php: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FAEPSS 0.1%CVE-2026-86719MEDIUMWWBN AVideo CustomizeUser Cross-Site Request Forgery Session HijackingEPSS 0.1%