{"schema_version":1,"title":"WWBN AVideo vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 196 vulnerabilities in WWBN AVideo: 1 in the last 7 days and 135 in the last 90 days, 11 of them critical and 0 exploited in the wild. The most recent, CVE-2026-100630, was published on 26 September 2026.","url":"https://junglewise.ai/threats/technologies/avideo","json_url":"https://junglewise.ai/threats/technologies/avideo.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/avideo","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":73,"all_time":196,"critical":11,"exploited":0,"last_7_days":1,"last_30_days":113,"last_90_days":135,"last_365_days":195},"latest":[{"cve":"CVE-2026-100630","cvss":5.4,"slug":"cve-2026-100630-avideo-contains-a-stored-cross-site-scripting-vulnerability-in","title":"AVideo stored cross-site scripting in trailer1 field","severity":"medium","exploited":false,"published_at":"2026-09-26T14:16:44.26+00:00","url":"https://junglewise.ai/threats/cve-2026-100630-avideo-contains-a-stored-cross-site-scripting-vulnerability-in"},{"cve":"CVE-2026-92915","cvss":7.3,"epss":0.0042,"slug":"cve-2026-92915-wwbn-avideo-broken-access-control-in-email-verification","title":"WWBN AVideo broken access control in email verification","severity":"high","exploited":false,"published_at":"2026-09-17T12:18:30.573+00:00","url":"https://junglewise.ai/threats/cve-2026-92915-wwbn-avideo-broken-access-control-in-email-verification"},{"cve":"CVE-2026-92914","cvss":8.1,"epss":0.0048,"slug":"cve-2026-92914-avideo-logincontrol-pgp-second-factor-authentication-bypass","title":"AVideo LoginControl PGP second factor authentication bypass","severity":"high","exploited":false,"published_at":"2026-09-17T12:18:30.44+00:00","url":"https://junglewise.ai/threats/cve-2026-92914-avideo-logincontrol-pgp-second-factor-authentication-bypass"},{"cve":"CVE-2026-92913","cvss":7.4,"epss":0.0053,"slug":"cve-2026-92913-avideo-weak-prng-in-activation-code-generation","title":"AVideo weak PRNG in activation code generation","severity":"high","exploited":false,"published_at":"2026-09-17T12:18:30.29+00:00","url":"https://junglewise.ai/threats/cve-2026-92913-avideo-weak-prng-in-activation-code-generation"},{"cve":"CVE-2026-92912","cvss":6.5,"epss":0.0031,"slug":"cve-2026-92912-avideo-weak-cryptographic-prng-for-rtmp-publish-keys","title":"AVideo weak cryptographic PRNG for RTMP publish keys","severity":"medium","exploited":false,"published_at":"2026-09-17T12:18:30.123+00:00","url":"https://junglewise.ai/threats/cve-2026-92912-avideo-weak-cryptographic-prng-for-rtmp-publish-keys"},{"cve":"CVE-2026-92586","cvss":4.3,"epss":0.0026,"slug":"cve-2026-92586-avideo-missing-authorization-in-comment-api-endpoint","title":"AVideo missing authorization in comment API endpoint","severity":"medium","exploited":false,"published_at":"2026-09-16T22:18:29.157+00:00","url":"https://junglewise.ai/threats/cve-2026-92586-avideo-missing-authorization-in-comment-api-endpoint"},{"cve":"CVE-2026-92585","cvss":4.3,"epss":0.0026,"slug":"cve-2026-92585-avideo-missing-authorization-check-in-like-api-endpoint","title":"AVideo missing authorization check in like API endpoint","severity":"medium","exploited":false,"published_at":"2026-09-16T22:18:29.027+00:00","url":"https://junglewise.ai/threats/cve-2026-92585-avideo-missing-authorization-check-in-like-api-endpoint"},{"cve":"CVE-2026-92584","cvss":6.1,"epss":0.0026,"slug":"cve-2026-92584-avideo-stored-cross-site-scripting-in-statistics-view","title":"AVideo stored cross-site scripting in statistics view","severity":"medium","exploited":false,"published_at":"2026-09-16T22:18:28.89+00:00","url":"https://junglewise.ai/threats/cve-2026-92584-avideo-stored-cross-site-scripting-in-statistics-view"},{"cve":"CVE-2026-92583","cvss":6.5,"epss":0.003,"slug":"cve-2026-92583-avideo-rate-limit-bypass-via-non-atomic-counter-increment","title":"AVideo rate limit bypass via non-atomic counter increment","severity":"medium","exploited":false,"published_at":"2026-09-16T22:18:28.747+00:00","url":"https://junglewise.ai/threats/cve-2026-92583-avideo-rate-limit-bypass-via-non-atomic-counter-increment"},{"cve":"CVE-2026-92582","cvss":7.1,"epss":0.0018,"slug":"cve-2026-92582-wwbn-avideo-csrf-bypass-in-videoaddnew-json-php","title":"WWBN AVideo CSRF bypass in videoAddNew.json.php","severity":"high","exploited":false,"published_at":"2026-09-16T22:18:28.6+00:00","url":"https://junglewise.ai/threats/cve-2026-92582-wwbn-avideo-csrf-bypass-in-videoaddnew-json-php"},{"cve":"CVE-2026-92581","cvss":4.3,"epss":0.0029,"slug":"cve-2026-92581-avideo-like-counter-desynchronization-via-array-parameter","title":"AVideo Like counter desynchronization via array parameter","severity":"medium","exploited":false,"published_at":"2026-09-16T22:18:28.47+00:00","url":"https://junglewise.ai/threats/cve-2026-92581-avideo-like-counter-desynchronization-via-array-parameter"},{"cve":"CVE-2026-92580","cvss":8.8,"epss":0.0145,"slug":"cve-2026-92580-avideo-clonesite-plugin-stored-os-command-injection-via-ssh","title":"AVideo CloneSite plugin stored OS command injection via SSH password","severity":"high","exploited":false,"published_at":"2026-09-16T22:18:28.333+00:00","url":"https://junglewise.ai/threats/cve-2026-92580-avideo-clonesite-plugin-stored-os-command-injection-via-ssh"},{"cve":"CVE-2026-92579","cvss":5.4,"epss":0.0027,"slug":"cve-2026-92579-avideo-broken-access-control-in-csrf-exemption-allowlist","title":"AVideo broken access control in CSRF exemption allowlist","severity":"medium","exploited":false,"published_at":"2026-09-16T22:18:28.193+00:00","url":"https://junglewise.ai/threats/cve-2026-92579-avideo-broken-access-control-in-csrf-exemption-allowlist"},{"cve":"CVE-2026-92578","cvss":8.1,"epss":0.0062,"slug":"cve-2026-92578-wwbn-avideo-authentication-bypass-via-stored-password-hash","title":"WWBN AVideo authentication bypass via stored password hash","severity":"high","exploited":false,"published_at":"2026-09-16T22:18:28.053+00:00","url":"https://junglewise.ai/threats/cve-2026-92578-wwbn-avideo-authentication-bypass-via-stored-password-hash"},{"cve":"CVE-2026-92577","cvss":7.5,"epss":0.0043,"slug":"cve-2026-92577-wwbn-avideo-api-broken-access-control-via-clean-title","title":"WWBN AVideo API broken access control via clean_title","severity":"high","exploited":false,"published_at":"2026-09-16T22:18:27.91+00:00","url":"https://junglewise.ai/threats/cve-2026-92577-wwbn-avideo-api-broken-access-control-via-clean-title"},{"cve":"CVE-2026-91967","cvss":5,"epss":0.0034,"slug":"cve-2026-91967-avideo-ssrf-in-getheadercontenttypefromurl-via-stored-video-link","title":"AVideo SSRF in getHeaderContentTypeFromURL via stored video link","severity":"medium","exploited":false,"published_at":"2026-09-15T16:17:52.933+00:00","url":"https://junglewise.ai/threats/cve-2026-91967-avideo-ssrf-in-getheadercontenttypefromurl-via-stored-video-link"},{"cve":"CVE-2026-91966","cvss":5.8,"epss":0.004,"slug":"cve-2026-91966-avideo-unauthenticated-ssrf-in-check-site-availability","title":"AVideo unauthenticated SSRF in check_site_availability","severity":"medium","exploited":false,"published_at":"2026-09-15T16:17:52.783+00:00","url":"https://junglewise.ai/threats/cve-2026-91966-avideo-unauthenticated-ssrf-in-check-site-availability"},{"cve":"CVE-2026-91965","cvss":7.5,"epss":0.0045,"slug":"cve-2026-91965-wwbn-avideo-broken-access-control-in-live-endpoints","title":"WWBN AVideo broken access control in Live endpoints","severity":"high","exploited":false,"published_at":"2026-09-15T16:17:52.643+00:00","url":"https://junglewise.ai/threats/cve-2026-91965-wwbn-avideo-broken-access-control-in-live-endpoints"},{"cve":"CVE-2026-90552","cvss":4.3,"epss":0.0036,"slug":"cve-2026-90552-wwbn-avideo-missing-authorization-in-playlist-schedule-endpoints","title":"WWBN AVideo missing authorization in playlist schedule endpoints","severity":"medium","exploited":false,"published_at":"2026-09-12T13:16:53.747+00:00","url":"https://junglewise.ai/threats/cve-2026-90552-wwbn-avideo-missing-authorization-in-playlist-schedule-endpoints"},{"cve":"CVE-2026-90551","cvss":5.3,"epss":0.004,"slug":"cve-2026-90551-wwbn-avideo-missing-authorization-in-video-from-program-api","title":"WWBN AVideo missing authorization in video_from_program API","severity":"medium","exploited":false,"published_at":"2026-09-12T13:16:53.603+00:00","url":"https://junglewise.ai/threats/cve-2026-90551-wwbn-avideo-missing-authorization-in-video-from-program-api"},{"cve":"CVE-2026-90550","cvss":5.3,"epss":0.0041,"slug":"cve-2026-90550-wwbn-avideo-missing-authorization-in-playerskins-mediasession","title":"WWBN AVideo missing authorization in PlayerSkins mediaSession.json.php","severity":"medium","exploited":false,"published_at":"2026-09-12T13:16:53.467+00:00","url":"https://junglewise.ai/threats/cve-2026-90550-wwbn-avideo-missing-authorization-in-playerskins-mediasession"},{"cve":"CVE-2026-90549","cvss":5.3,"epss":0.0034,"slug":"cve-2026-90549-wwbn-avideo-missing-authorization-in-videosandroid-json-php","title":"WWBN AVideo missing authorization in videosAndroid.json.php endpoint","severity":"medium","exploited":false,"published_at":"2026-09-12T13:16:53.32+00:00","url":"https://junglewise.ai/threats/cve-2026-90549-wwbn-avideo-missing-authorization-in-videosandroid-json-php"},{"cve":"CVE-2026-90548","cvss":5.3,"epss":0.004,"slug":"cve-2026-90548-wwbn-avideo-missing-authorization-in-imagegallery-list-json-php","title":"WWBN AVideo missing authorization in ImageGallery list.json.php","severity":"medium","exploited":false,"published_at":"2026-09-12T13:16:53.187+00:00","url":"https://junglewise.ai/threats/cve-2026-90548-wwbn-avideo-missing-authorization-in-imagegallery-list-json-php"},{"cve":"CVE-2026-90547","cvss":5.3,"epss":0.0041,"slug":"cve-2026-90547-wwbn-avideo-missing-authorization-in-bookmark-plugin","title":"WWBN AVideo missing authorization in Bookmark plugin","severity":"medium","exploited":false,"published_at":"2026-09-12T13:16:53.05+00:00","url":"https://junglewise.ai/threats/cve-2026-90547-wwbn-avideo-missing-authorization-in-bookmark-plugin"},{"cve":"CVE-2026-90546","cvss":4.3,"epss":0.0036,"slug":"cve-2026-90546-wwbn-avideo-missing-authorization-in-like-json-php","title":"WWBN AVideo missing authorization in like.json.php","severity":"medium","exploited":false,"published_at":"2026-09-12T13:16:52.913+00:00","url":"https://junglewise.ai/threats/cve-2026-90546-wwbn-avideo-missing-authorization-in-like-json-php"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":1,"exploited":0,"vulnerabilities":10},{"week":"2026-07-20","critical":1,"exploited":0,"vulnerabilities":2},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":1,"exploited":0,"vulnerabilities":2},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":7},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":8},{"week":"2026-08-31","critical":5,"exploited":0,"vulnerabilities":27},{"week":"2026-09-07","critical":1,"exploited":0,"vulnerabilities":61},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":17},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":1}],"related":[],"technology":{"hub":true,"name":"WWBN AVideo","slug":"avideo","vendor":{"name":"WWBN","slug":"wwbn","url":"https://junglewise.ai/threats/vendors/wwbn"},"aliases":[],"category":"video-hosting","url":"https://junglewise.ai/threats/technologies/avideo"},"most_severe":[{"cve":"CVE-2026-86189","cvss":9.8,"epss":0.0071,"slug":"cve-2026-86189-wwbn-avideo-path-traversal-in-notify-ffmpeg-json-php","title":"WWBN AVideo path traversal in notify.ffmpeg.json.php","severity":"critical","exploited":false,"published_at":"2026-09-05T13:18:14+00:00","url":"https://junglewise.ai/threats/cve-2026-86189-wwbn-avideo-path-traversal-in-notify-ffmpeg-json-php"},{"cve":"CVE-2026-85154","cvss":9.8,"epss":0.0064,"slug":"cve-2026-85154-wwbn-avideo-authentication-bypass-in-video-id-hash-credential","title":"WWBN AVideo authentication bypass in video_id_hash credential","severity":"critical","exploited":false,"published_at":"2026-09-03T13:06:22.067+00:00","url":"https://junglewise.ai/threats/cve-2026-85154-wwbn-avideo-authentication-bypass-in-video-id-hash-credential"},{"cve":"CVE-2026-84480","cvss":9.8,"epss":0.0051,"slug":"cve-2026-84480-wwbn-avideo-password-recovery-token-expiration-bypass","title":"WWBN AVideo password recovery token expiration bypass","severity":"critical","exploited":false,"published_at":"2026-09-01T23:17:22.22+00:00","url":"https://junglewise.ai/threats/cve-2026-84480-wwbn-avideo-password-recovery-token-expiration-bypass"},{"cve":"CVE-2026-64625","cvss":9.8,"slug":"cve-2026-64625-wwbn-avideo-os-command-injection-in-execasync","title":"WWBN AVideo OS command injection in execAsync","severity":"critical","exploited":false,"published_at":"2026-07-20T22:17:18.74+00:00","url":"https://junglewise.ai/threats/cve-2026-64625-wwbn-avideo-os-command-injection-in-execasync"},{"cve":"CVE-2023-25313","cvss":9.6,"epss":0.0132,"slug":"cve-2023-25313-wwbn-avideo-command-injection-in-video-embedding","title":"WWBN AVideo command injection in video embedding","severity":"critical","exploited":false,"published_at":"2023-02-02T01:32:42+00:00","url":"https://junglewise.ai/threats/cve-2023-25313-wwbn-avideo-command-injection-in-video-embedding"},{"cve":"CVE-2026-54458","cvss":9.6,"epss":0.0051,"slug":"cve-2026-54458-wwbn-avideo-stored-dom-xss-in-yptsocket-plugin","title":"WWBN AVideo stored DOM XSS in YPTSocket plugin","severity":"critical","exploited":false,"published_at":"2026-07-15T22:17:19.16+00:00","url":"https://junglewise.ai/threats/cve-2026-54458-wwbn-avideo-stored-dom-xss-in-yptsocket-plugin"},{"cvss":9.6,"slug":"wwbn-avideo-unauthenticated-stored-dom-xss-in-yptsocket-plugin-227d9154","title":"WWBN AVideo unauthenticated stored DOM XSS in YPTSocket plugin","severity":"critical","exploited":false,"published_at":"2026-06-04T18:57:50+00:00","url":"https://junglewise.ai/threats/wwbn-avideo-unauthenticated-stored-dom-xss-in-yptsocket-plugin-227d9154"},{"cve":"CVE-2026-88869","cvss":9.3,"epss":0.0053,"slug":"cve-2026-88869-avideo-ad-server-stored-xss-in-log-php-label-parameter","title":"AVideo AD_Server stored XSS in log.php label parameter","severity":"critical","exploited":false,"published_at":"2026-09-10T14:17:14.637+00:00","url":"https://junglewise.ai/threats/cve-2026-88869-avideo-ad-server-stored-xss-in-log-php-label-parameter"},{"cve":"CVE-2026-72748","cvss":9.1,"epss":0.0119,"slug":"cve-2026-72748-avideo-unauthenticated-arbitrary-file-write-in-encoder-endpoint","title":"AVideo unauthenticated arbitrary file write in encoder endpoint","severity":"critical","exploited":false,"published_at":"2026-08-11T13:19:05.813+00:00","url":"https://junglewise.ai/threats/cve-2026-72748-avideo-unauthenticated-arbitrary-file-write-in-encoder-endpoint"},{"cve":"CVE-2026-84479","cvss":9.1,"epss":0.0055,"slug":"cve-2026-84479-wwbn-avideo-authentication-bypass-via-user-agent-header","title":"WWBN AVideo authentication bypass via User-Agent header","severity":"critical","exploited":false,"published_at":"2026-09-01T23:17:22.083+00:00","url":"https://junglewise.ai/threats/cve-2026-84479-wwbn-avideo-authentication-bypass-via-user-agent-header"}],"generated_at":"2026-09-26T19:07:00.176898+00:00"}