Vendor
WWBN
350 known vulnerabilities.
Products
350 results · Feed
-
High 8.8
An insufficient entropy vulnerability exists in the userRecoverPass.php recoverPass generation functionality of WWBN AV…
-
Medium 5.3
WWBN AVideo recovery notification bypass vulnerability
A recovery notification bypass vulnerability exists in the userRecoverPass.php captcha validation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to the silent creation of a recovery pass code for any user.
-
High 7.3
WWBN AVideo Improper Restriction of Excessive Authentication Attempts vulnerability
A login attempt restriction bypass vulnerability exists in the checkLoginAttempts functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to captcha bypass, which can be abused by an attacker to brute force user cr…
-
Critical 9.8
WWBN AVideo Insufficient Entropy vulnerbaility
An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted series of HTTP requests can lead to privilege escalation. An attacker can gather system information via HTTP req…
-
High 8.8CVE-2023-32073 Public exploit
AVideo command injection vulnerability
WWBN AVideo is an open source video platform. In versions 12.4 and prior, a command injection vulnerability exists at `plugin/CloneSite/cloneClient.json.php` which allows Remote Code Execution if you CloneSite Plugin. This is a bypass to the fix for CVE-2023-…
-
High 8.0
WWBN/AVideo stored XSS vulnerability leads to takeover of any user's account, including admin's account
WWBN AVideo is an open source video platform. In AVideo prior to version 12.4, a normal user can make a Meeting Schedule where the user can invite another user in that Meeting, but it does not properly sanitize the malicious characters when creating a Meeting…
-
High 8.8CVE-2023-30854 Public exploit
WWBN AVideo vulnerable to OS Command Injection
AVideo is an open source video platform. Prior to version 12.4, an OS Command Injection vulnerability in an authenticated endpoint `/plugin/CloneSite/cloneClient.json.php` allows attackers to achieve Remote Code Execution. This issue is fixed in version 12.4.
-
High 8.3
A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364.…
-
High 8.3
A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364.…
-
High 8.3
A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364.…
-
High 8.3
A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364.…
-
High 7.5
An information disclosure vulnerability exists in the cookie functionality of WWBN AVideo 11.6 and dev master commit 3f…
-
High 7.5
An information disclosure vulnerability exists in the cookie functionality of WWBN AVideo 11.6 and dev master commit 3f…
-
Critical 9.6CVE-2022-32772 Scanner template
A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master…
-
Critical 9.6CVE-2022-32771 Scanner template
A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master…
-
Critical 9.6CVE-2022-32770 Scanner template
A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master…
-
Medium 4.8
Multiple authentication bypass vulnerabilities exist in the objects id handling functionality of WWBN AVideo 11.6 and d…
-
Medium 4.8
Multiple authentication bypass vulnerabilities exist in the objects id handling functionality of WWBN AVideo 11.6 and d…
-
Medium 6.5
An information disclosure vulnerability exists in the aVideoEncoderReceiveImage functionality of WWBN AVideo 11.6 and d…
-
Critical 9.9CVE-2022-32572 EPSS 25%
An os command injection vulnerability exists in the aVideoEncoder wget functionality of WWBN AVideo 11.6 and dev master…
-
High 7.2
An improper password check exists in the login functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. An att…
-
Critical 9.6CVE-2022-30690 EPSS 84%
A cross-site scripting (xss) vulnerability exists in the image403 functionality of WWBN AVideo 11.6 and dev master comm…
-
High 8.8
A privilege escalation vulnerability exists in the session id functionality of WWBN AVideo 11.6 and dev master commit 3…
-
Critical 9.9CVE-2022-30547 EPSS 65%
A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commi…
-
Critical 9.9CVE-2022-30534 EPSS 76%
An OS command injection vulnerability exists in the aVideoEncoder chunkfile functionality of WWBN AVideo 11.6 and dev m…
-
High 8.8
A cross-site request forgery (CSRF) vulnerability exists in WWBN AVideo 11.6 and dev master commit 3f7c0364. A speciall…
-
Critical 9.0
A cross-site scripting (xss) vulnerability exists in the videoAddNew functionality of WWBN AVideo 11.6 and dev master c…
-
Medium 6.5
An information disclosure vulnerability exists in the chunkFile functionality of WWBN AVideo 11.6 and dev master commit…
-
Critical 9.6
A reflected cross-site scripting (xss) vulnerability exists in the charts tab selection functionality of WWBN AVideo 11…
-
High 7.7
Authorization Bypass in AVideo Platform
AVideo Platform is an open-source Audio and Video platform. It is similar to a self-hosted YouTube. In AVideo Platform before version 10.2 there is an authorization bypass vulnerability which enables an ordinary user to get admin control. This is fixed in ver…