What’s Vulnerable › Products

WWBN AVideo vulnerabilities

280 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 232 published in the last 12 months.

Check whether your WWBN AVideo version is affected

Latest WWBN AVideo vulnerabilities

• CVE-2026-116800 — WWBN AVideo before 29.5.0 Local PHP File Inclusion via Accept-Language Header (CVSS 6.2)
• CVE-2026-116139 — WWBN AVideo 26.0 through 29.3.0 Stored XSS via Comment Markdown Rendering (CVSS 5.4)
• CVE-2026-114634 — WWBN AVideo before 29.4.0 Blind SSRF via getHeaderContentTypeFromURL Redirect (CVSS 4.3)
• CVE-2026-114633 — WWBN AVideo before 29.4.0 Incorrect Authorization via confirmDeleteUser.json.php (CVSS 6.5)
• CVE-2026-114048 — WWBN AVideo before 24.0 CSRF via Legacy Playlist and Video Endpoints (CVSS 3.5)
• CVE-2026-105089 — WWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHPFlix2 Templates (CVSS 8.7)
• CVE-2026-105086 — WWBN AVideo 12.4 through 29.2.0 Stored XSS via Double-Encoded Video Title (CVSS 8.7)
• CVE-2026-100630 — AVideo before 29.1.0 Stored XSS via HTML Entity Bypass in trailer1 Field (CVSS 5.4)
• CVE-2026-92915 — WWBN AVideo userVerifyEmail.php Unauthenticated Access Control (CVSS 7.3)
• CVE-2026-92914 — AVideo LoginControl PGP Second Factor Authentication Bypass (CVSS 8.1)
• CVE-2026-92586 — AVideo through 29.0 Missing Authorization via comment API endpoint (CVSS 4.3)
• CVE-2026-92585 — AVideo through 29.0 Missing Authorization Check via API Like Endpoint (CVSS 4.3)
• CVE-2026-92584 — AVideo through 29.0 Stored Cross-Site Scripting via User-Agent Header (CVSS 6.1)
• CVE-2026-92583 — AVideo through 29.0 Rate Limit Bypass via Non-Atomic Counter Increment (CVSS 6.5)
• CVE-2026-92582 — AVideo through 29.0 Broken Access Control via videoAddNew.json.php CSRF Bypass (CVSS 7.1)
• CVE-2026-92581 — AVideo through 29.0 Like Counter Desynchronization via Array Parameter (CVSS 4.3)
• CVE-2026-92580 — AVideo through 29.0 CloneSite Stored Shell Injection via SSH Password CSRF (CVSS 8.8)
• CVE-2026-92579 — AVideo through 29.0 Broken Access Control via CSRF Exemption Basename Collision (CVSS 5.4)
• CVE-2026-92578 — WWBN AVideo through 29.0 Authentication Bypass via Stored Password Hash (CVSS 8.1)
• CVE-2026-92577 — AVideo through 29.0 API get_api_video Broken Access Control via clean_title (CVSS 7.5)
• CVE-2026-91967 — AVideo through 29.0 Blind SSRF via getHeaderContentTypeFromURL (CVSS 5.0)
• CVE-2026-91966 — AVideo through 29.0 Unauthenticated SSRF via Host Header (CVSS 5.8)
• CVE-2026-91965 — WWBN AVideo through 29.0 Broken Access Control via Live Endpoints (CVSS 7.5)
• CVE-2026-89257 — AVideo through 29.0 Cross-User Category Asset Deletion via Missing Ownership Check (CVSS 5.4)
• CVE-2026-86729 — WWBN AVideo Unrestricted Authentication Attempts via get_api_preauthorize (CVSS 7.4)