Vulnerabilities in WWBN

323 results
Vexday analysis

O portfólio de vulnerabilidades do WWBN reúne 187 CVEs catalogadas, com 30 classificadas como críticas e 67 surgidas apenas nos últimos 90 dias — volume recente que indica aceleração no ritmo de descoberta e demanda atenção contínua ao ciclo de atualização. Embora nenhuma CVE esteja no catálogo KEV da CISA, situando a taxa de exploração ativa abaixo da média geral do catálogo, o CVE-2022-30690 apresenta EPSS de 0,8358, sinalizando alta probabilidade estimada de exploração e devendo ser tratado com prioridade. A falha mais recorrente é CWE-79 (Cross-Site Scripting), categoria que, combinada com a existência de ao menos uma prova de conceito pública, amplia a superfície de risco para ambientes que ainda não aplicaram as correções disponíveis.

CVE-2026-88867CRITICALWWBN AVideo Stored XSS via Category Name and Icon ClassEPSS 0.3%CVE-2026-86728HIGHAVideo through 29.0 Unauthenticated Disclosure via epg.json.phpEPSS 0.3%CVE-2026-33480HIGHAVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks ProxyEPSS 0.3%CVE-2026-33763MEDIUMAVideo has an Unauthenticated Video Password Brute-Force Vulnerability via Unrate-Limited Boolean OracleEPSS 0.3%CVE-2026-88876HIGHAVideo PlayerSkins seo.php Missing Authorization Password-Protected VODEPSS 0.3%CVE-2026-64626MEDIUMAVideo Encoder downloadURL SSRF via unpinned retry fallbackEPSS 0.3%CVE-2026-34364MEDIUMAVideo has User Group-Based Category Access Control Bypass via Missing and Broken Group Filtering in categories.json.phpEPSS 0.3%CVE-2026-35448LOWWWBN AVideo Provides Unauthenticated Access to Payment Order Data via BlockonomicsYPT check.phpEPSS 0.3%CVE-2026-45578HIGHWWBN AVideo Live: OS command injection in on_publish.php execAsync via unescaped m3u8 URLEPSS 0.3%CVE-2026-33035MEDIUMUnauthenticated Reflected XSS via innerHTML in AVideoEPSS 0.3%CVE-2026-84479CRITICALWWBN AVideo Authentication Bypass via User-Agent HeaderEPSS 0.3%CVE-2026-34395MEDIUMAVideo: Mass User PII Disclosure via Missing Authorization in YPTWallet users.json.phpEPSS 0.3%CVE-2026-33685MEDIUMAVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User DataEPSS 0.3%CVE-2026-88866CRITICALWWBN AVideo LoginControl Stored XSS via User-Agent HeaderEPSS 0.3%CVE-2026-92915MEDIUMWWBN AVideo userVerifyEmail.php Unauthenticated Access ControlEPSS 0.3%CVE-2026-86727HIGHAVideo through 29.0 Information Disclosure via stats.json.phpEPSS 0.3%CVE-2026-86725HIGHAVideo SocialMediaPublisher Missing Authorization via add.json.phpEPSS 0.3%CVE-2026-41060HIGHAVideo's SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURLEPSS 0.3%CVE-2026-33492HIGHAVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session RegenerationEPSS 0.3%CVE-2026-34375HIGHAVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment PageEPSS 0.3%