CVE-2026-56341highCWE-862

CVE-2026-56341: fallo de gravedad alta en AVideo

AVideo - Unauthenticated Access to Payment Log DataTables Endpoints via list.json.php

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear AVideo+ Monitorear wwbn/avideo

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.7epss 0.5%
AVideo through version 26.0 contains multiple unauthenticated list.json.php endpoints in payment plugins lacking authorization checks, exposing PayPal tokens, Authorize.Net webhooks, and Bitcoin transaction records. Unauthenticated attackers can retrieve all payment transaction data including agreement IDs, user financial records, and API responses via direct GET requests to vulnerable endpoints.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Productos afectados
AVideo · AVideo
CVEs relacionadas — AVideo

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-56346MEDIUMAVideo - Unauthenticated PGP Message Decryption via decryptMessage.json.php EndpointEPSS 0.6%CVE-2026-56345CRITICALAVideo - Arbitrary User Session Hijacking via Meet Plugin uploadRecordedVideo EndpointEPSS 0.5%CVE-2026-56342MEDIUMAVideo - Server-Side Request Forgery in Live/test.php via statsURL ParameterEPSS 0.4%CVE-2026-60092MEDIUMAVideo - Stored Cross-Site Scripting via Unescaped User-Agent in Participants PanelEPSS 0.3%