# WWBN AVideo. Every CVE that names WWBN AVideo among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [WWBN AVideo before 29.5.0 Local PHP File Inclusion via Accept-Language Header](https://agentprime.io/advisories/CVE-2026-116800.md) `CVE-2026-116800` · CVE record: WWBN AVideo · CVSS 6.9 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Path traversal - [WWBN AVideo 26.0 through 29.3.0 Stored XSS via Comment Markdown Rendering](https://agentprime.io/advisories/CVE-2026-116139.md) `CVE-2026-116139` · CVE record: WWBN AVideo · CVSS 5.1 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Cross-site scripting (XSS) - [WWBN AVideo before 29.4.0 Blind SSRF via getHeaderContentTypeFromURL Redirect](https://agentprime.io/advisories/CVE-2026-114634.md) `CVE-2026-114634` · CVE record: WWBN AVideo · CVSS 5.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Server-side request forgery (SSRF) - [WWBN AVideo before 29.4.0 Incorrect Authorization via confirmDeleteUser.json.php](https://agentprime.io/advisories/CVE-2026-114633.md) `CVE-2026-114633` · CVE record: WWBN AVideo · CVSS 7.0 High · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control - [WWBN AVideo before 24.0 CSRF via Legacy Playlist and Video Endpoints](https://agentprime.io/advisories/CVE-2026-114048.md) `CVE-2026-114048` · CVE record: WWBN AVideo · CVSS 5.1 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site request forgery (CSRF) - [WWBN AVideo 12.4 through 29.2.0 Stored XSS via Double-Encoded Video Title](https://agentprime.io/advisories/CVE-2026-105086.md) `CVE-2026-105086` · CVE record: WWBN AVideo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Oct 2026 · Tags: Cross-site scripting (XSS) - [WWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHPFlix2 Templates](https://agentprime.io/advisories/CVE-2026-105089.md) `CVE-2026-105089` · CVE record: WWBN AVideo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Oct 2026 · Tags: Cross-site scripting (XSS) - [AVideo before 29.1.0 Stored XSS via HTML Entity Bypass in trailer1 Field](https://agentprime.io/advisories/CVE-2026-100630.md) `CVE-2026-100630` · CVE record: WWBN AVideo · CVSS 5.1 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Cross-site scripting (XSS) - [WWBN AVideo userVerifyEmail.php Unauthenticated Access Control](https://agentprime.io/advisories/CVE-2026-92915.md) `CVE-2026-92915` · CVE record: WWBN AVideo · CVSS 6.9 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Denial of service - [AVideo LoginControl PGP Second Factor Authentication Bypass](https://agentprime.io/advisories/CVE-2026-92914.md) `CVE-2026-92914` · CVE record: WWBN AVideo · CVSS 8.6 High · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass - [AVideo Weak PRNG Activation Code Authentication Bypass](https://agentprime.io/advisories/CVE-2026-92913.md) `CVE-2026-92913` · CVE record: WWBN AVideo · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Weak cryptography or TLS - [AVideo Cryptographically Weak PRNG via uniqid Stream Key](https://agentprime.io/advisories/CVE-2026-92912.md) `CVE-2026-92912` · CVE record: WWBN AVideo · CVSS 8.3 High · Not analysed yet · Published 17 Sept 2026 · Tags: Weak cryptography or TLS - [AVideo through 29.0 Missing Authorization via comment API endpoint](https://agentprime.io/advisories/CVE-2026-92586.md) `CVE-2026-92586` · CVE record: WWBN AVideo · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Broken access control - [AVideo through 29.0 Missing Authorization Check via API Like Endpoint](https://agentprime.io/advisories/CVE-2026-92585.md) `CVE-2026-92585` · CVE record: WWBN AVideo · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Broken access control - [AVideo through 29.0 Stored Cross-Site Scripting via User-Agent Header](https://agentprime.io/advisories/CVE-2026-92584.md) `CVE-2026-92584` · CVE record: WWBN AVideo · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Cross-site scripting (XSS) - [AVideo through 29.0 Rate Limit Bypass via Non-Atomic Counter Increment](https://agentprime.io/advisories/CVE-2026-92583.md) `CVE-2026-92583` · CVE record: WWBN AVideo · CVSS 6.9 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Authentication bypass - [AVideo through 29.0 Broken Access Control via videoAddNew.json.php CSRF Bypass](https://agentprime.io/advisories/CVE-2026-92582.md) `CVE-2026-92582` · CVE record: WWBN AVideo · CVSS 7.1 High · Not analysed yet · Published 16 Sept 2026 · Tags: Cross-site request forgery (CSRF) - [AVideo through 29.0 Like Counter Desynchronization via Array Parameter](https://agentprime.io/advisories/CVE-2026-92581.md) `CVE-2026-92581` · CVE record: WWBN AVideo · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-20 - [AVideo through 29.0 CloneSite Stored Shell Injection via SSH Password CSRF](https://agentprime.io/advisories/CVE-2026-92580.md) `CVE-2026-92580` · CVE record: WWBN AVideo · CVSS 8.7 High · Not analysed yet · Published 16 Sept 2026 · Tags: Command injection - [AVideo through 29.0 Broken Access Control via CSRF Exemption Basename Collision](https://agentprime.io/advisories/CVE-2026-92579.md) `CVE-2026-92579` · CVE record: WWBN AVideo · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-289 - [WWBN AVideo through 29.0 Authentication Bypass via Stored Password Hash](https://agentprime.io/advisories/CVE-2026-92578.md) `CVE-2026-92578` · CVE record: WWBN AVideo · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Authentication bypass - [AVideo through 29.0 API get_api_video Broken Access Control via clean_title](https://agentprime.io/advisories/CVE-2026-92577.md) `CVE-2026-92577` · CVE record: WWBN AVideo · CVSS 8.7 High · Not analysed yet · Published 16 Sept 2026 · Tags: Broken access control - [AVideo through 29.0 Blind SSRF via getHeaderContentTypeFromURL](https://agentprime.io/advisories/CVE-2026-91967.md) `CVE-2026-91967` · CVE record: WWBN AVideo · CVSS 5.3 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Server-side request forgery (SSRF) - [AVideo through 29.0 Unauthenticated SSRF via Host Header](https://agentprime.io/advisories/CVE-2026-91966.md) `CVE-2026-91966` · CVE record: WWBN AVideo · CVSS 6.9 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Server-side request forgery (SSRF) - [WWBN AVideo through 29.0 Broken Access Control via Live Endpoints](https://agentprime.io/advisories/CVE-2026-91965.md) `CVE-2026-91965` · CVE record: WWBN AVideo · CVSS 8.7 High · Not analysed yet · Published 15 Sept 2026 · Tags: Information disclosure - [WWBN AVideo Missing Authorization via Playlists_schedules list.json.php](https://agentprime.io/advisories/CVE-2026-90552.md) `CVE-2026-90552` · CVE record: WWBN AVideo · CVSS 5.3 Medium · Not analysed yet · Published 12 Sept 2026 · Tags: Broken access control - [WWBN AVideo Missing Authorization via video_from_program API](https://agentprime.io/advisories/CVE-2026-90551.md) `CVE-2026-90551` · CVE record: WWBN AVideo · CVSS 6.9 Medium · Not analysed yet · Published 12 Sept 2026 · Tags: Broken access control - [WWBN AVideo Missing Authorization via mediaSession.json.php](https://agentprime.io/advisories/CVE-2026-90550.md) `CVE-2026-90550` · CVE record: WWBN AVideo · CVSS 6.9 Medium · Not analysed yet · Published 12 Sept 2026 · Tags: Information disclosure - [WWBN AVideo Missing Authorization via videosAndroid.json.php Endpoint](https://agentprime.io/advisories/CVE-2026-90549.md) `CVE-2026-90549` · CVE record: WWBN AVideo · CVSS 6.9 Medium · Not analysed yet · Published 12 Sept 2026 · Tags: Information disclosure - [WWBN AVideo Missing Authorization in ImageGallery list.json.php](https://agentprime.io/advisories/CVE-2026-90548.md) `CVE-2026-90548` · CVE record: WWBN AVideo · CVSS 6.9 Medium · Not analysed yet · Published 12 Sept 2026 · Tags: Information disclosure - [WWBN AVideo Missing Authorization via getBookmarks.json.php](https://agentprime.io/advisories/CVE-2026-90547.md) `CVE-2026-90547` · CVE record: WWBN AVideo · CVSS 6.9 Medium · Not analysed yet · Published 12 Sept 2026 · Tags: Broken access control - [WWBN AVideo Missing Authorization via like.json.php](https://agentprime.io/advisories/CVE-2026-90546.md) `CVE-2026-90546` · CVE record: WWBN AVideo · CVSS 5.3 Medium · Not analysed yet · Published 12 Sept 2026 · Tags: Broken access control - [WWBN AVideo Missing Authorization via commentAddNew.json.php](https://agentprime.io/advisories/CVE-2026-90545.md) `CVE-2026-90545` · CVE record: WWBN AVideo · CVSS 5.3 Medium · Not analysed yet · Published 12 Sept 2026 · Tags: Broken access control - [WWBN AVideo Missing Authorization via videoAddViewCount.json.php](https://agentprime.io/advisories/CVE-2026-90544.md) `CVE-2026-90544` · CVE record: WWBN AVideo · CVSS 5.3 Medium · Not analysed yet · Published 12 Sept 2026 · Tags: Broken access control - [WWBN AVideo Missing Authentication via socketMessageLiveOwner.json.php](https://agentprime.io/advisories/CVE-2026-90543.md) `CVE-2026-90543` · CVE record: WWBN AVideo · CVSS 6.9 Medium · Not analysed yet · Published 12 Sept 2026 · Tags: Authentication bypass - [WWBN AVideo Missing Authorization via remindMe.json.php](https://agentprime.io/advisories/CVE-2026-90542.md) `CVE-2026-90542` · CVE record: WWBN AVideo · CVSS 5.3 Medium · Not analysed yet · Published 12 Sept 2026 · Tags: Broken access control - [WWBN AVideo Unauthenticated Information Disclosure via menus.json.php](https://agentprime.io/advisories/CVE-2026-90541.md) `CVE-2026-90541` · CVE record: WWBN AVideo · CVSS 6.9 Medium · Not analysed yet · Published 12 Sept 2026 · Tags: Information disclosure - [WWBN AVideo Missing Authorization via playListAddVideo.json.php](https://agentprime.io/advisories/CVE-2026-90540.md) `CVE-2026-90540` · CVE record: WWBN AVideo · CVSS 5.3 Medium · Not analysed yet · Published 12 Sept 2026 · Tags: Broken access control - [WWBN AVideo Missing Authentication via menuItems.json.php](https://agentprime.io/advisories/CVE-2026-90539.md) `CVE-2026-90539` · CVE record: WWBN AVideo · CVSS 6.9 Medium · Not analysed yet · Published 12 Sept 2026 · Tags: Information disclosure - [WWBN AVideo Missing Authorization via playlistsFromUser.json.php](https://agentprime.io/advisories/CVE-2026-90538.md) `CVE-2026-90538` · CVE record: WWBN AVideo · CVSS 6.9 Medium · Not analysed yet · Published 12 Sept 2026 · Tags: Information disclosure - [WWBN AVideo Scheduler sendEmail Missing Authorization via Token](https://agentprime.io/advisories/CVE-2026-90537.md) `CVE-2026-90537` · CVE record: WWBN AVideo · CVSS 8.8 High · Not analysed yet · Published 12 Sept 2026 · Tags: Broken access control - [WWBN AVideo Missing Authorization via adsInfo API Endpoint](https://agentprime.io/advisories/CVE-2026-90536.md) `CVE-2026-90536` · CVE record: WWBN AVideo · CVSS 6.9 Medium · Not analysed yet · Published 12 Sept 2026 · Tags: Information disclosure - [AVideo through 29.0 Cross-User Category Asset Deletion via Missing Ownership Check](https://agentprime.io/advisories/CVE-2026-89257.md) `CVE-2026-89257` · CVE record: WWBN AVideo · CVSS 5.3 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Broken access control - [AVideo Bookmark Plugin Stored XSS via Chapter Names](https://agentprime.io/advisories/CVE-2026-89256.md) `CVE-2026-89256` · CVE record: WWBN AVideo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS) - [AVideo LoginControl Stored XSS via PGP Public Key](https://agentprime.io/advisories/CVE-2026-89255.md) `CVE-2026-89255` · CVE record: WWBN AVideo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS) - [AVideo CustomizeUser Stored XSS via field_name Parameter](https://agentprime.io/advisories/CVE-2026-89254.md) `CVE-2026-89254` · CVE record: WWBN AVideo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS) - [AVideo Stored XSS via donationLink in watch page button](https://agentprime.io/advisories/CVE-2026-89253.md) `CVE-2026-89253` · CVE record: WWBN AVideo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS) - [AVideo Missing Authorization in addLiveLink.php LiveLink Update](https://agentprime.io/advisories/CVE-2026-89252.md) `CVE-2026-89252` · CVE record: WWBN AVideo · CVSS 7.1 High · Not analysed yet · Published 11 Sept 2026 · Tags: Broken access control - [AVideo Missing Authorization via AD_Server log.php Wallet Credit](https://agentprime.io/advisories/CVE-2026-89251.md) `CVE-2026-89251` · CVE record: WWBN AVideo · CVSS 7.1 High · Not analysed yet · Published 11 Sept 2026 · Tags: CWE-345 - [WWBN AVideo Unauthenticated File Read via getRecordedFile.php](https://agentprime.io/advisories/CVE-2026-89250.md) `CVE-2026-89250` · CVE record: WWBN AVideo · CVSS 8.7 High · Not analysed yet · Published 11 Sept 2026 · Tags: Authentication bypass - [AVideo YPTWallet Stored XSS via CryptoWallet Configuration](https://agentprime.io/advisories/CVE-2026-89249.md) `CVE-2026-89249` · CVE record: WWBN AVideo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS) - [AVideo WebRTC Plugin Information Disclosure via status.json.php](https://agentprime.io/advisories/CVE-2026-89248.md) `CVE-2026-89248` · CVE record: WWBN AVideo · CVSS 6.9 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Information disclosure - [WWBN AVideo XML Injection via plugin/AD_Server/VMAP.php](https://agentprime.io/advisories/CVE-2026-89247.md) `CVE-2026-89247` · CVE record: WWBN AVideo · CVSS 5.3 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Other injection - [WWBN AVideo CSV Formula Injection via myComments.download.php](https://agentprime.io/advisories/CVE-2026-89246.md) `CVE-2026-89246` · CVE record: WWBN AVideo · CVSS 5.1 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Other injection - [WWBN AVideo Cross-Site Request Forgery via playlistRemove.php](https://agentprime.io/advisories/CVE-2026-89245.md) `CVE-2026-89245` · CVE record: WWBN AVideo · CVSS 7.1 High · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site request forgery (CSRF) - [WWBN AVideo Reflected XSS via Gallery Category getBackURL](https://agentprime.io/advisories/CVE-2026-89244.md) `CVE-2026-89244` · CVE record: WWBN AVideo · CVSS 5.3 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS) - [WWBN AVideo Stored XSS via UserGroups setGroup_name](https://agentprime.io/advisories/CVE-2026-89243.md) `CVE-2026-89243` · CVE record: WWBN AVideo · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS) - [WWBN AVideo Unauthenticated SSRF via login.json.php](https://agentprime.io/advisories/CVE-2026-89242.md) `CVE-2026-89242` · CVE record: WWBN AVideo · CVSS 6.9 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Server-side request forgery (SSRF) - [WWBN AVideo Reflected XSS via confirmLivePassword.php](https://agentprime.io/advisories/CVE-2026-89241.md) `CVE-2026-89241` · CVE record: WWBN AVideo · CVSS 5.3 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS) - [WWBN AVideo Reflected XSS via confirmLivePassword.php](https://agentprime.io/advisories/CVE-2026-89240.md) `CVE-2026-89240` · CVE record: WWBN AVideo · CVSS 5.3 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS) Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .