# WWBN AVideo vulnerabilities Source: https://junglewise.ai/threats/technologies/avideo Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 11 November 2026, 22:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/avideo.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 250 vulnerabilities in WWBN AVideo: 12 in the last 7 days and 141 in the last 90 days, 17 of them critical and 0 exploited in the wild. The most recent, CVE-2026-126810, was published on 11 November 2026. 8 vulnerabilities in the last four weeks, down 60% on the four before (20). 1 critical against 0. ## Counts - Last 7 days: 12 - Last 30 days: 18 - Last 90 days: 141 - All time: 250 (17 critical, 0 exploited in the wild) ## About WWBN AVideo AVideo is an open-source video hosting and streaming platform. ## Latest WWBN AVideo vulnerabilities - [CVE-2026-126810: WWBN AVideo stored cross-site scripting in channel feed](https://junglewise.ai/threats/cve-2026-126810-wwbn-avideo-29-1-0-through-29-7-1-contains-a-stored-cross-site) (medium, CVSS 5.4, published 11 Nov 2026) - [CVE-2026-126809: WWBN AVideo missing authorization in import and file operations](https://junglewise.ai/threats/cve-2026-126809-wwbn-avideo-through-29-7-1-contains-a-missing-authorization) (high, CVSS 7.1, published 11 Nov 2026) - [CVE-2026-126806: WWBN AVideo stored cross-site scripting in video download link](https://junglewise.ai/threats/cve-2026-126806-wwbn-avideo-14-3-through-29-7-1-contains-a-stored-cross-site) (high, CVSS 8.7, published 11 Nov 2026) - [CVE-2026-126805: WWBN AVideo incorrect authorization in encoder endpoints](https://junglewise.ai/threats/cve-2026-126805-wwbn-avideo-through-29-7-1-contains-an-incorrect-authorization) (high, CVSS 7.2, published 11 Nov 2026) - [CVE-2026-126804: WWBN AVideo path traversal in ADs plugin deleteImage.json.php](https://junglewise.ai/threats/cve-2026-126804-wwbn-avideo-12-4-through-29-7-1-contains-a-path-traversal) (high, CVSS 8.1, published 11 Nov 2026) - [CVE-2026-126545: WWBN AVideo missing authorization in API tags endpoint](https://junglewise.ai/threats/cve-2026-126545-wwbn-avideo-through-29-7-1-contains-a-missing-authorization) (medium, CVSS 4.3, published 11 Nov 2026) - [CVE-2026-126544: WWBN AVideo email verification bypass in User::verifyCode()](https://junglewise.ai/threats/cve-2026-126544-wwbn-avideo-6-5-through-29-7-1-contains-an-email-verification) (medium, CVSS 4.3, published 11 Nov 2026) - [CVE-2026-126543: WWBN AVideo improper payment verification in PayPal IPN handler](https://junglewise.ai/threats/cve-2026-126543-wwbn-avideo-through-29-7-1-contains-an-improper-payment) (high, CVSS 7.5, published 11 Nov 2026) - [CVE-2026-126542: WWBN AVideo authentication bypass in Hybridauth social login](https://junglewise.ai/threats/cve-2026-126542-wwbn-avideo-6-5-through-29-7-1-contains-an-authentication-bypass) (critical, CVSS 9.8, published 11 Nov 2026) - [CVE-2026-126541: WWBN AVideo Live plugin authorization bypass in restream endpoints](https://junglewise.ai/threats/cve-2026-126541-wwbn-avideo-through-29-7-1-contains-a-missing-authorization) (high, CVSS 8.1, published 11 Nov 2026) - [CVE-2026-124424: WWBN AVideo path traversal in AI plugin receiveAsync.json.php](https://junglewise.ai/threats/cve-2026-124424-wwbn-avideo-contains-a-path-traversal-vulnerability-in-plugin-ai) (high, CVSS 7.1, published 8 Nov 2026) - [CVE-2026-123486: WWBN AVideo race condition in PayPal IPN deduplication](https://junglewise.ai/threats/cve-2026-123486-wwbn-avideo-29-0-through-29-4-0-contains-a-race-condition) (medium, CVSS 5.3, published 6 Nov 2026) - [CVE-2026-61573: AVideo reflected XSS in login interface via unencoded URL and form parameters](https://junglewise.ai/threats/cve-2026-61573-avideo-is-a-video-sharing-platform-prior-to-8-1-0-the-anonymous) (medium, CVSS 6.1, published 28 Oct 2026) - [CVE-2026-61564: AVideo unauthenticated code injection in installer](https://junglewise.ai/threats/cve-2026-61564-avideo-is-a-video-sharing-platform-prior-to-8-1-0-the) (critical, CVSS 10, published 28 Oct 2026) - [CVE-2026-116800: WWBN AVideo local file inclusion in language code validation](https://junglewise.ai/threats/cve-2026-116800-wwbn-avideo-before-29-5-0-contains-a-local-file-inclusion) (medium, CVSS 6.2, published 27 Oct 2026) - [CVE-2026-116139: WWBN AVideo stored cross-site scripting in comments](https://junglewise.ai/threats/cve-2026-116139-wwbn-avideo-26-0-through-29-3-0-contains-a-stored-cross-site) (medium, CVSS 5.4, published 25 Oct 2026) - [CVE-2026-114634: WWBN AVideo server-side request forgery in getHeaderContentTypeFromURL()](https://junglewise.ai/threats/cve-2026-114634-wwbn-avideo-before-29-4-0-contains-a-blind-server-side-request) (medium, CVSS 4.3, published 22 Oct 2026) - [CVE-2026-114633: WWBN AVideo incorrect authorization in admin account management](https://junglewise.ai/threats/cve-2026-114633-wwbn-avideo-before-29-4-0-contains-an-incorrect-authorization) (medium, CVSS 6.5, published 22 Oct 2026) - [CVE-2026-105089: WWBN AVideo stored cross-site scripting in video trailer](https://junglewise.ai/threats/cve-2026-105089-wwbn-avideo-through-29-2-0-contains-a-stored-cross-site) (high, CVSS 8.7, published 4 Oct 2026) - [CVE-2026-105086: WWBN AVideo stored XSS in video titles via double encoding](https://junglewise.ai/threats/cve-2026-105086-wwbn-avideo-12-4-through-29-2-0-contains-a-stored-cross-site) (high, CVSS 8.7, published 4 Oct 2026) - [CVE-2026-100630: AVideo stored cross-site scripting in trailer1 field](https://junglewise.ai/threats/cve-2026-100630-avideo-contains-a-stored-cross-site-scripting-vulnerability-in) (medium, CVSS 5.4, published 26 Sep 2026) - [CVE-2026-92915: WWBN AVideo broken access control in email verification](https://junglewise.ai/threats/cve-2026-92915-wwbn-avideo-broken-access-control-in-email-verification) (high, CVSS 7.3, published 17 Sep 2026) - [CVE-2026-92914: AVideo LoginControl PGP second factor authentication bypass](https://junglewise.ai/threats/cve-2026-92914-avideo-logincontrol-pgp-second-factor-authentication-bypass) (high, CVSS 8.1, published 17 Sep 2026) - [CVE-2026-92913: AVideo weak PRNG in activation code generation](https://junglewise.ai/threats/cve-2026-92913-avideo-weak-prng-in-activation-code-generation) (high, CVSS 7.4, published 17 Sep 2026) - [CVE-2026-92912: AVideo weak cryptographic PRNG for RTMP publish keys](https://junglewise.ai/threats/cve-2026-92912-avideo-weak-cryptographic-prng-for-rtmp-publish-keys) (medium, CVSS 6.5, published 17 Sep 2026) ## Most severe WWBN AVideo vulnerabilities - [CVE-2026-40911: WWBN AVideo is an open source video platform. In versions 29.0 and prior, the YPTSocket plugin's WebSocket server…](https://junglewise.ai/threats/cve-2026-40911-wwbn-avideo-yptsocket-websocket-broadcast-relay-leads-to) (critical, CVSS 10, published 21 Apr 2026) - [CVE-2026-61564: AVideo unauthenticated code injection in installer](https://junglewise.ai/threats/cve-2026-61564-avideo-is-a-video-sharing-platform-prior-to-8-1-0-the) (critical, CVSS 10, published 28 Oct 2026) - [CVE-2026-41304: WWBN AVideo: RCE cause by clonesite plugin](https://junglewise.ai/threats/cve-2026-41304-wwbn-avideo-rce-cause-by-clonesite-plugin) (critical, CVSS 9.8, published 22 Apr 2026) - [CVE-2026-86189: WWBN AVideo path traversal in notify.ffmpeg.json.php](https://junglewise.ai/threats/cve-2026-86189-wwbn-avideo-path-traversal-in-notify-ffmpeg-json-php) (critical, CVSS 9.8, published 5 Sep 2026) - [CVE-2026-85154: WWBN AVideo authentication bypass in video_id_hash credential](https://junglewise.ai/threats/cve-2026-85154-wwbn-avideo-authentication-bypass-in-video-id-hash-credential) (critical, CVSS 9.8, published 3 Sep 2026) - [CVE-2026-84480: WWBN AVideo password recovery token expiration bypass](https://junglewise.ai/threats/cve-2026-84480-wwbn-avideo-password-recovery-token-expiration-bypass) (critical, CVSS 9.8, published 1 Sep 2026) - [CVE-2026-33770: AVideo has SQL Injection in category.php fixCleanTitle() via Unparameterized clean_title and id Variables](https://junglewise.ai/threats/cve-2026-33770-avideo-has-sql-injection-in-category-php-fixcleantitle-via) (critical, CVSS 9.8, published 27 Mar 2026) - [CVE-2026-126542: WWBN AVideo authentication bypass in Hybridauth social login](https://junglewise.ai/threats/cve-2026-126542-wwbn-avideo-6-5-through-29-7-1-contains-an-authentication-bypass) (critical, CVSS 9.8, published 11 Nov 2026) - [CVE-2026-64625: WWBN AVideo OS command injection in execAsync](https://junglewise.ai/threats/cve-2026-64625-wwbn-avideo-os-command-injection-in-execasync) (critical, CVSS 9.8, published 20 Jul 2026) - [CVE-2023-25313: WWBN AVideo command injection in video embedding](https://junglewise.ai/threats/cve-2023-25313-wwbn-avideo-command-injection-in-video-embedding) (critical, CVSS 9.6, published 2 Feb 2023) ## Vulnerabilities per week 8 vulnerabilities in the last four weeks, down 60% on the four before (20). 1 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 7 | 0 | 0 | | 24 Aug 2026 | 8 | 0 | 0 | | 31 Aug 2026 | 27 | 5 | 0 | | 7 Sep 2026 | 61 | 1 | 0 | | 14 Sep 2026 | 17 | 0 | 0 | | 21 Sep 2026 | 1 | 0 | 0 | | 28 Sep 2026 | 2 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 3 | 0 | 0 | | 26 Oct 2026 | 3 | 1 | 0 | | 2 Nov 2026 | 2 | 0 | 0 | | 9 Nov 2026 | 10 | 1 | 0 | ## Other WWBN technologies - [WWBN AVideo Encoder](https://junglewise.ai/threats/technologies/avideo-encoder): 4 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "WWBN AVideo vulnerabilities", https://junglewise.ai/threats/technologies/avideo, 11 November 2026.