Vulnerabilidades en WWBN

323 resultados
Análisis Vexday

O portfólio de vulnerabilidades do WWBN reúne 187 CVEs catalogadas, com 30 classificadas como críticas e 67 surgidas apenas nos últimos 90 dias — volume recente que indica aceleração no ritmo de descoberta e demanda atenção contínua ao ciclo de atualização. Embora nenhuma CVE esteja no catálogo KEV da CISA, situando a taxa de exploração ativa abaixo da média geral do catálogo, o CVE-2022-30690 apresenta EPSS de 0,8358, sinalizando alta probabilidade estimada de exploração e devendo ser tratado com prioridade. A falha mais recorrente é CWE-79 (Cross-Site Scripting), categoria que, combinada com a existência de ao menos uma prova de conceito pública, amplia a superfície de risco para ambientes que ainda não aplicaram as correções disponíveis.

CVE-2023-49810HIGHA login attempt restriction bypass vulnerability exists in the checkLoginAttempts functionality of WWBN AVideo dev master commit 15fed957fb.EPSS 0.7%CVE-2026-40909HIGHWWBN AVideo has a Path Traversal in Locale Save Endpoint that Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE)EPSS 0.7%CVE-2026-40911CRITICALWWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() SinksEPSS 0.6%CVE-2026-33647HIGHAVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File UploadEPSS 0.6%CVE-2026-33648HIGHAVideo Vulnerable to OS Command Injection via Unsanitized `users_id` and `liveTransmitionHistory_id` in Restreamer Log File PathEPSS 0.6%CVE-2026-33483HIGHAVideo Affected by Unauthenticated Disk Space Exhaustion via Unlimited Temp File Creation in aVideoEncoderChunk.json.phpEPSS 0.6%CVE-2026-64625CRITICALAVideo before 29.0 OS Command Injection via execAsyncEPSS 0.6%CVE-2023-48730HIGHA cross-site scripting (xss) vulnerability exists in the navbarMenuAndLogo.php user name functionality of WWBN AVideo dev master commit 15feEPSS 0.6%CVE-2026-49279HIGHWWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass)EPSS 0.5%CVE-2026-33479HIGHAVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against AdminEPSS 0.5%CVE-2026-88874HIGHAVideo through c3edcc274c389816d434acadac07ee78eaf330c1 Authentication BypassEPSS 0.5%CVE-2026-33767HIGHAVideo has SQL Injection via Partial Prepared Statement — videos_id Concatenated Directly into QueryEPSS 0.5%CVE-2026-92913CRITICALAVideo Weak PRNG Activation Code Authentication BypassEPSS 0.5%CVE-2026-54458CRITICALAVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket PluginEPSS 0.5%CVE-2026-33293HIGHAVideo Affected by Arbitrary File Deletion via Path Traversal in CloneSite deleteDump ParameterEPSS 0.5%CVE-2026-33681HIGHAVideo has Path Traversal in pluginRunDatabaseScript.json.php Enables Arbitrary SQL File Execution via Unsanitized Plugin NameEPSS 0.5%CVE-2026-33770HIGHAVideo has SQL Injection in category.php fixCleanTitle() via Unparameterized clean_title and id VariablesEPSS 0.5%CVE-2026-29093HIGHWWBN AVideo: Unauthenticated PHP session store exposed to host network via published memcached portEPSS 0.5%CVE-2026-33038HIGHAVideo affected by unauthenticated application takeover via exposed web installer on uninitialized deploymentsEPSS 0.5%CVE-2026-88869CRITICALAVideo AD_Server Stored XSS via log.php label parameterEPSS 0.5%