wwbn

Top products

The 15 most recently published vulnerabilities affecting wwbn.

• CVE-2026-64626AVideo Encoder downloadURL SSRF via unpinned retry fallback6.4Jul 20, 2026
• CVE-2026-64625AVideo before 29.0 OS Command Injection via execAsync9.8Jul 20, 2026
• CVE-2026-33731AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data6.5Jul 16, 2026
• CVE-2026-55173AVideo incomplete fix for CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command execution at the same execAsync sh -c sink8.1Jul 16, 2026
• CVE-2026-33692AVideo Has Unauthenticated .env File Exposure via Official Docker Compose Configuration7.5Jul 16, 2026
• CVE-2026-63305AVideo through 29.0 OS Command Injection via ffmpeg.json.php8.1Jul 16, 2026
• CVE-2026-63304AVideo through 29.0 OS Command Injection via listFFmpegProcesses8.1Jul 16, 2026
• CVE-2026-54458AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin9.6Jul 15, 2026
• CVE-2026-50183WWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery Section4.7Jul 15, 2026
• CVE-2026-50182AVideo Has Unauthenticated Reflected XSS via $_GET['search'] in YouTubeAPI Gallery Pagination6.1Jul 15, 2026
• CVE-2026-33684AVideo's Privilege AVideo: Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet Permissions5.3Jul 15, 2026
• CVE-2026-56347AVideo TopMenu Plugin - Stored Cross-Site Scripting via Unescaped Menu Item Fields6.1Jun 20, 2026
• CVE-2026-45580WWBN AVideo Live: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute5.4May 29, 2026
• CVE-2026-45578WWBN AVideo Live: OS command injection in on_publish.php execAsync via unescaped m3u8 URL8.8May 29, 2026
• CVE-2026-45610WWBN AVideo plugin/LoginControl/set.json.php: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA5.7May 29, 2026