83160 matches found
CVE-2026-90552
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate playlist ownership in the Playlists_schedules/list.json.php and Live/calendar.json.php endpoints. This missing authorization check allows both authenticated users with canStream privileges and unauthenticated us...
CVE-2026-90551
WWBN AVideo (through commit c3edcc274) has a missing authorization flaw in its video_from_program API endpoint, which fails to validate playlist ownership before returning results. An unauthenticated network attacker can query the endpoint to enumerate private playlist names, owner information, a...
CVE-2026-90550
WWBN AVideo (through commit c3edcc27) is affected by a missing authorization vulnerability in the PlayerSkins mediaSession.json.php endpoint. The endpoint fails to verify user authorization before returning video metadata, allowing unauthenticated attackers to supply a video ID parameter and retr...
CVE-2026-90549
WWBN AVideo , a PHP-based video platform, is vulnerable to missing authorization on the videosAndroid.json.php endpoint in versions through commit c3edcc274c389816d434acadac07ee78eaf330c1. Unauthenticated attackers can send a simple GET request to the endpoint and retrieve metadata of password-pr...
CVE-2026-90548
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization flaw in the ImageGallery list.json.php endpoint. The endpoint fails to validate user permissions, allowing unauthenticated attackers to retrieve filenames and URLs of password-protected image gall...
CVE-2026-90547
WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) contains an authorization flaw in the Bookmark plugin 's getBookmarks.json.php endpoint. The endpoint fails to validate user permissions, allowing unauthenticated attackers to query it with a video ID parameter and retrieve cha...
CVE-2026-90545
WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1 ) fails to validate video access permissions in the commentAddNew.json.php endpoint. This missing authorization check allows authenticated users to post comments on videos that are password-protected or group-restricted, effecti...
CVE-2026-90546
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization flaw in the like.json.php endpoint. The application fails to validate video access permissions before processing like requests, allowing any logged-in user to submit likes on password-protected an...
CVE-2026-90544
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the videoAddViewCount.json.php endpoint before updating view statistics. Authenticated attackers with low privileges can increment view counts and watch-time on videos they cannot acc...
CVE-2026-90542
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization flaw in remindMe.json.php . The application fails to verify that a logged-in user can actually access a given live schedule before allowing the creation of a reminder. As a result, any authenticat...
EUVD-2026-76860
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate that logged-in users can access live schedules before creating reminders via remindMe.json.php. Authenticated attackers can create scheduler reminders for private live schedules they cannot view and learn the...
CVE-2026-90540
WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) contains a missing authorization flaw in the playListAddVideo.json.php endpoint. The endpoint fails to validate watch permissions when adding videos to playlists, allowing authenticated attackers to add password-protected video...
CVE-2026-90538
WWBN AVideo versions through commit c3edcc274c389816d434acadac07ee78eaf330c1 contain a missing authorization vulnerability in playlistsFromUser.json.php . The root cause is improper cache keying that conflates requests across different user contexts, allowing unauthenticated attackers to retrieve...
EUVD-2026-76856
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in playlistsFromUser.json.php that allows unauthenticated attackers to read private playlists by requesting another user's identifier. Attackers can retrieve Favorite and Watch Later...
EUVD-2026-76855
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/Scheduler/sendEmail.json.php that allows unauthenticated attackers to access scheduler email jobs by providing a site-wide daily token. Attackers can enumerate scheduler...
CVE-2026-90537
CVE-2026-90537 affects WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) in the file plugin/Scheduler/sendEmail.json.php . The root cause is a missing authorization check : an unauthenticated attacker can access scheduler email jobs by supplying any valid site-wide daily token...
EUVD-2026-76854
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to authorize access to the adsInfo API endpoint, allowing unauthenticated attackers to retrieve password-protected video owner identifiers. Attackers can call the adsInfo API with a videosid parameter to obtain the owner's...
CVE-2026-90536
WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) contains a missing authorization flaw in the adsInfo API endpoint . Unauthenticated attackers can call the endpoint with a videos_id parameter to retrieve password-protected video owner identifiers (user IDs) and personalized a...
CVE-2024-50395
CVE-2024-50395 Información de CVE Se ha reportado una vulnerabilidad de omisión de autorización mediante una clave controlada por el usuario que afecta al complemento Media Streaming. Si se explota, la vulnerabilidad podría permitir a atacantes de la red local obtener privilegios. Ya hemos...