Vulnerabilities in WWBN

323 results
Vexday analysis

O portfólio de vulnerabilidades do WWBN reúne 187 CVEs catalogadas, com 30 classificadas como críticas e 67 surgidas apenas nos últimos 90 dias — volume recente que indica aceleração no ritmo de descoberta e demanda atenção contínua ao ciclo de atualização. Embora nenhuma CVE esteja no catálogo KEV da CISA, situando a taxa de exploração ativa abaixo da média geral do catálogo, o CVE-2022-30690 apresenta EPSS de 0,8358, sinalizando alta probabilidade estimada de exploração e devendo ser tratado com prioridade. A falha mais recorrente é CWE-79 (Cross-Site Scripting), categoria que, combinada com a existência de ao menos uma prova de conceito pública, amplia a superfície de risco para ambientes que ainda não aplicaram as correções disponíveis.

CVE-2026-85154CRITICALWWBN AVideo Authentication Bypass via Non-Expiring video_id_hashEPSS 0.3%CVE-2026-33043HIGHAVideo affected by Session Hijacking via Unauthenticated Session ID Disclosure with Permissive CORSEPSS 0.3%CVE-2026-34374CRITICALAVideo has SQL Injection in Live_schedule::keyExists() via Unparameterized Stream KeyEPSS 0.3%CVE-2026-33297MEDIUMAVideo has an IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.phpEPSS 0.3%CVE-2026-34733MEDIUMAVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI GuardEPSS 0.3%CVE-2026-33237MEDIUMAVideo has SSRF in Scheduler Plugin via callbackURL Missing `isSSRFSafeURL()` ValidationEPSS 0.3%CVE-2026-41056HIGHAVideos has CORS Origin Reflection with Credentials on Sensitive API Endpoints that Enables Cross-Origin Account TakeoverEPSS 0.3%CVE-2026-33493HIGHAVideo has a Path Traversal in import.json.php that Allows Private Video Theft and Arbitrary File Read/Deletion via fileURI ParameterEPSS 0.3%CVE-2026-41064CRITICALAVideo has an incomplete fix for CVE-2026-33502 (Command Injection)EPSS 0.3%CVE-2026-59808HIGHAVideo Authentication Bypass via Unkeyed Video Hash DisclosureEPSS 0.3%CVE-2026-35449MEDIUMWWBN AVideo has Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.phpEPSS 0.3%CVE-2026-92578CRITICALWWBN AVideo through 29.0 Authentication Bypass via Stored Password HashEPSS 0.3%CVE-2026-33684MEDIUMAVideo's Privilege AVideo: Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet PermissionsEPSS 0.3%CVE-2026-91967MEDIUMAVideo through 29.0 Blind SSRF via getHeaderContentTypeFromURLEPSS 0.3%CVE-2026-33041MEDIUMAVideo has an Unauthenticated Password Hash Oracle via encryptPass.json.phpEPSS 0.3%CVE-2026-92914HIGHAVideo LoginControl PGP Second Factor Authentication BypassEPSS 0.3%CVE-2026-81678MEDIUMAVideo SSRF Guard Bypass via IPv6 Transition AddressesEPSS 0.3%CVE-2026-33319MEDIUMAVideo Vulnerable to OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell CommandEPSS 0.3%CVE-2026-88867CRITICALWWBN AVideo Stored XSS via Category Name and Icon ClassEPSS 0.3%CVE-2026-89256CRITICALAVideo Bookmark Plugin Stored XSS via Chapter NamesEPSS 0.3%