What’s Vulnerable › Vulnerabilities

CVE-2026-81732: WWBN AVideo through 30.0 Information Disclosure via report4.json.php

• Severity: medium (CVSS 6.9 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-28 · updated 2026-08-29
• Weakness: CWE-200

Description

WWBN AVideo through version 30.0 fails to enforce authentication on the report4.json.php and report4.1.json.php endpoints, allowing unauthenticated access to user registration statistics. Attackers can send GET requests to these endpoints to retrieve daily and cumulative user-registration counts without any session or authorization.

Affected products

• WWBN AVideo: through 30.0

References

• https://github.com/WWBN/AVideo/security/advisories/GHSA-xv5m-gpmp-m72c
• https://www.vulncheck.com/advisories/wwbn-avideo-through-30.0-information-disclosure-via-report4-json-php
• https://github.com/WWBN/AVideo/security/advisories/GHSA-xv5m-gpmp-m72c

Get alerted when CVE-2026-81732 or the next vulnerability affects your stack