Vulnerabilidades en WWBN

323 resultados
Análisis Vexday

O portfólio de vulnerabilidades do WWBN reúne 187 CVEs catalogadas, com 30 classificadas como críticas e 67 surgidas apenas nos últimos 90 dias — volume recente que indica aceleração no ritmo de descoberta e demanda atenção contínua ao ciclo de atualização. Embora nenhuma CVE esteja no catálogo KEV da CISA, situando a taxa de exploração ativa abaixo da média geral do catálogo, o CVE-2022-30690 apresenta EPSS de 0,8358, sinalizando alta probabilidade estimada de exploração e devendo ser tratado com prioridade. A falha mais recorrente é CWE-79 (Cross-Site Scripting), categoria que, combinada com a existência de ao menos uma prova de conceito pública, amplia a superfície de risco para ambientes que ainda não aplicaram as correções disponíveis.

CVE-2026-33759MEDIUMAVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist ContentsEPSS 0.3%CVE-2026-84480CRITICALWWBN AVideo Password Recovery Token Expiration BypassEPSS 0.3%CVE-2026-50182MEDIUMAVideo Has Unauthenticated Reflected XSS via $_GET['search'] in YouTubeAPI Gallery PaginationEPSS 0.3%CVE-2026-43875MEDIUMWWBN AVideo: Password Hash Leaked in MobileManager OAuth Redirect URL Enables Account TakeoverEPSS 0.3%CVE-2026-86721HIGHAVideo through c3edcc274c Authorization Bypass via Session CookieEPSS 0.3%CVE-2026-34737MEDIUMAVideo: Arbitrary Stripe Subscription Cancellation via Debug Endpoint and retrieveSubscriptions() BugEPSS 0.3%CVE-2026-89254CRITICALAVideo CustomizeUser Stored XSS via field_name ParameterEPSS 0.3%CVE-2026-89249CRITICALAVideo YPTWallet Stored XSS via CryptoWallet ConfigurationEPSS 0.3%CVE-2026-34716MEDIUMAVideo: DOM XSS via Unsanitized Display Name in WebSocket Call NotificationEPSS 0.3%CVE-2026-84208HIGHAVideo User_Location Plugin Unauthenticated SQL InjectionEPSS 0.3%CVE-2026-33688MEDIUMAVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery EndpointEPSS 0.3%CVE-2026-85155HIGHWWBN AVideo SQL Injection via get.json.php APIName channelsEPSS 0.3%CVE-2026-33294MEDIUMAVideo has SSRF in BulkEmbed Thumbnail Fetch that Allows Reading Internal Network ResourcesEPSS 0.3%CVE-2026-59256HIGHWWBN AVideo Unbound Token Authorization Bypass via GalleryEPSS 0.3%CVE-2026-43881MEDIUMWWBN AVideo: Unauthenticated User Enumeration in `objects/users.json.php` via `isCompany` Parameter Flips `$ignoreAdmin = true` and Defeats Admin-Only Listing GuardEPSS 0.3%CVE-2026-86190CRITICALWWBN AVideo Broken Access Control via videoViewsInfo hash ParameterEPSS 0.3%CVE-2026-86723HIGHAVideo LoginControl PGP Authentication Bypass via verifyChallengeEPSS 0.3%CVE-2026-86722HIGHAVideo Authentication Bypass via SQL Cache InvalidationEPSS 0.3%CVE-2026-40907MEDIUMWWBN AVideo has IDOR in Live Restreams list.json.php that Exposes Other Users' Stream Keys and OAuth TokensEPSS 0.3%CVE-2026-84483MEDIUMWWBN AVideo Unauthenticated Password Hash Oracle via encryptPass.json.phpEPSS 0.3%