CVE-2026-90541 WWBN AVideo Unauthenticated Information Disclosure via menus.json.php

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to require authentication in the plugin/TopMenu/menus.json.php endpoint, allowing unauthenticated attackers to retrieve all menu data. Attackers can send GET requests to the endpoint to read inactive and admin-only menu nam...

CVE-2026-90541 WWBN AVideo Unauthenticated Information Disclosure via menus.json.php

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to require authentication in the plugin/TopMenu/menus.json.php endpoint, allowing unauthenticated attackers to retrieve all menu data. Attackers can send GET requests to the endpoint to read inactive and admin-only menu nam...

CVE-2026-90541

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is vulnerable to an unauthenticated information disclosure via the plugin/TopMenu/menus.json.php endpoint. The endpoint fails to enforce authentication, allowing any attacker to send a simple GET request and retrieve the full men...

CVE-2026-90541: Exposure of Sensitive Information to an Unauthorized Actor

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to require authentication in the plugin/TopMenu/menus.json.php endpoint, allowing unauthenticated attackers to retrieve all menu data. Attackers can send GET requests to the endpoint to read inactive and admin-only menu nam...

PT-2026-90646

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions through commit c3edcc274c389816d434acadac07ee78eaf330c1 Description An information disclosure issue exists where the system fails to require authentication for the 'plugin/TopMenu/menus.json.php' endpoint. Unauthenticated...