Vulnerabilities in WWBN

323 results
Vexday analysis

O portfólio de vulnerabilidades do WWBN reúne 187 CVEs catalogadas, com 30 classificadas como críticas e 67 surgidas apenas nos últimos 90 dias — volume recente que indica aceleração no ritmo de descoberta e demanda atenção contínua ao ciclo de atualização. Embora nenhuma CVE esteja no catálogo KEV da CISA, situando a taxa de exploração ativa abaixo da média geral do catálogo, o CVE-2022-30690 apresenta EPSS de 0,8358, sinalizando alta probabilidade estimada de exploração e devendo ser tratado com prioridade. A falha mais recorrente é CWE-79 (Cross-Site Scripting), categoria que, combinada com a existência de ao menos uma prova de conceito pública, amplia a superfície de risco para ambientes que ainda não aplicaram as correções disponíveis.

CVE-2026-34731HIGHAVideo: Unauthenticated Live Stream Termination via RTMP Callback on_publish_done.phpEPSS 0.5%CVE-2026-41058HIGHAVideo has an incomplete fix for CVE-2026-33293 (Path Traversal) in AVideoEPSS 0.5%CVE-2026-45731MEDIUMWWBN AVideo: Authenticated Arbitrary File Read in view/update.phpEPSS 0.5%CVE-2026-33485HIGHAVideo has an Unauthenticated Blind SQL Injection in RTMP on_publish Callback via Stream Name ParameterEPSS 0.5%CVE-2026-46337MEDIUMWWBN AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php`EPSS 0.5%CVE-2026-33039HIGHAVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxyEPSS 0.5%CVE-2026-33692HIGHAVideo Has Unauthenticated .env File Exposure via Official Docker Compose ConfigurationEPSS 0.5%CVE-2026-33502CRITICALAVideo has Unauthenticated SSRF via plugin/Live/test.phpEPSS 0.4%CVE-2026-33024CRITICALAVideo-Encoder has Unauthenticated Blind Server-Side Request Forgery via Public Thumbnail GeneratorEPSS 0.4%CVE-2026-33716CRITICALAVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.phpEPSS 0.4%CVE-2026-33352CRITICALAVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass)EPSS 0.4%CVE-2026-33351CRITICALAVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification BypassEPSS 0.4%CVE-2026-33501MEDIUMAVideo has Unauthenticated Information Disclosure of User Group Permission Mappings via Permissions PluginEPSS 0.4%CVE-2026-33238MEDIUMAVideo has a Path Traversal in listFiles.json.php that Enables Server Filesystem EnumerationEPSS 0.4%CVE-2026-39369HIGHWWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLsEPSS 0.4%CVE-2026-91965HIGHWWBN AVideo through 29.0 Broken Access Control via Live EndpointsEPSS 0.4%CVE-2026-86189CRITICALWWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg.json.phpEPSS 0.4%CVE-2026-33025HIGHAVideo-Encoder is Vulnerable to Authenticated SQL Injection via ORDER BY ClauseEPSS 0.4%CVE-2026-81732MEDIUMWWBN AVideo through 30.0 Information Disclosure via report4.json.phpEPSS 0.4%CVE-2026-33717HIGHAVideo Vulnerable to Remote Code Execution via Persistent PHP Temp File in Encoder downloadURL with Resolution Validation AbortEPSS 0.4%