CVE-2026-35448

CVE-2026-35448 affects WWBN AVideo prior to version 27.x (plugin: BlockonomicsYPT/check.php). The endpoint accepts a Bitcoin address via GET and returns the corresponding payment order data without any authentication or access control. This enables unauthenticated disclosure of sensitive fields s...