Vulnerabilidades en WWBN

323 resultados
Análisis Vexday

O portfólio de vulnerabilidades do WWBN reúne 187 CVEs catalogadas, com 30 classificadas como críticas e 67 surgidas apenas nos últimos 90 dias — volume recente que indica aceleração no ritmo de descoberta e demanda atenção contínua ao ciclo de atualização. Embora nenhuma CVE esteja no catálogo KEV da CISA, situando a taxa de exploração ativa abaixo da média geral do catálogo, o CVE-2022-30690 apresenta EPSS de 0,8358, sinalizando alta probabilidade estimada de exploração e devendo ser tratado com prioridade. A falha mais recorrente é CWE-79 (Cross-Site Scripting), categoria que, combinada com a existência de ao menos uma prova de conceito pública, amplia a superfície de risco para ambientes que ainda não aplicaram as correções disponíveis.

CVE-2026-86186MEDIUMAVideo API Rate Limit Bypass via Bot User-Agent HeaderEPSS 0.2%CVE-2026-90545MEDIUMWWBN AVideo Missing Authorization via commentAddNew.json.phpEPSS 0.2%CVE-2026-89246MEDIUMWWBN AVideo CSV Formula Injection via myComments.download.phpEPSS 0.2%CVE-2026-89257MEDIUMAVideo through 29.0 Cross-User Category Asset Deletion via Missing Ownership CheckEPSS 0.2%CVE-2026-86718HIGHWWBN AVideo Cross-Site Request Forgery via deleteHistory.json.phpEPSS 0.2%CVE-2026-33683MEDIUMAVideo vulnerable to Stored XSS via html_entity_decode() Reversing xss_esc() Sanitization in Channel About FieldEPSS 0.2%CVE-2026-33690MEDIUMAVideo vulnerable to IP Address Spoofing via Untrusted HTTP Headers in getRealIpAddr()EPSS 0.2%CVE-2026-88872HIGHAVideo CustomizeUser setPassword.json.php CSRFEPSS 0.2%CVE-2026-40925HIGHWWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP CredentialsEPSS 0.2%CVE-2026-89242MEDIUMWWBN AVideo Unauthenticated SSRF via login.json.phpEPSS 0.2%CVE-2026-41061MEDIUMWWBN AVideo Vulnerable to stored XSS via Unanchored Duration Regex in Video Encoder ReceiverEPSS 0.2%CVE-2026-33649HIGHAVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission ModificationEPSS 0.2%CVE-2026-92581MEDIUMAVideo through 29.0 Like Counter Desynchronization via Array ParameterEPSS 0.2%CVE-2026-81733MEDIUMWWBN AVideo through 30.0 CSRF via myLiveControls.save.json.phpEPSS 0.2%CVE-2026-39366MEDIUMWWBN AVideo Affected by a PayPal IPN Replay Attack Enabling Wallet Balance Inflation via Missing Transaction Deduplication in ipn.phpEPSS 0.2%CVE-2026-84477MEDIUMAVideo Stored XSS via Live Schedule Title DescriptionEPSS 0.2%CVE-2026-85159MEDIUMAVideo Reflected XSS via cancelUri in userLogin.phpEPSS 0.2%CVE-2026-43883MEDIUMWWBN AVideo: IDOR in PayPalYPT agreementCancel.json.php Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription AgreementsEPSS 0.2%CVE-2026-40926HIGHWWBN AVideo Vulnerable to CSRF in Admin JSON Endpoints (Category CRUD, Plugin Update Script)EPSS 0.2%CVE-2026-43879MEDIUMWWBN AVideo: Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT_FOLLOWLOCATION Redirect BypassEPSS 0.2%