EUVD-2026-67683
GHSA-6c5p-vcp5-h6f3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify internet-facing AVideo instance
-
ExploitSend unauthenticated HTTP GET to report4.json.php or report4.1.json.php
-
ImpactReceive JSON user registration statistics
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are required for exploitation. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N confirms remote unauthenticated exploitation against any network-accessible WWBN AVideo installation through version 30.0 in its default configuration. The vulnerable endpoints (report4.json.php and report4.1.json.php) ship with all affected versions and require no optional feature to be enabled. The only factor limiting exploitation is network reachability: internet-facing deployments are fully exposed to any actor on the internet, while instances hosted on isolated internal networks restrict exploitation to network-adjacent attackers. |
| Impact | The CVSS 4.0 score of 6.9 reflects the network-accessible, zero-authentication attack vector, but is tempered by low confidentiality impact (VC:L) and no integrity or availability impact (VI:N, VA:N). The exposed data - user registration counts - is low-sensitivity operational metadata rather than credentials, PII, or session tokens, meaningfully limiting direct harm. No EPSS score was provided in the available intelligence, and the vulnerability is absent from the CISA KEV catalog with no confirmed POC, placing real-world exploitation urgency well below what the headline score might suggest. The primary risk is competitive intelligence exposure and reconnaissance enablement: an attacker can infer platform activity levels and growth trajectories without gaining any additional system access. Organizations should patch promptly but this does not warrant emergency out-of-band treatment unless the platform handles sensitive community data where even aggregate statistics are confidential. |
| Exploit ScenarioDerived | An unauthenticated remote attacker sends a plain HTTP GET request to https://[target]/report4.json.php and immediately receives a JSON response containing user registration statistics. No credentials, tokens, special headers, or tooling beyond a standard HTTP client such as curl or a web browser are required, making exploitation trivially automatable against any internet-exposed AVideo instance. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 28, 2026
Unauthenticated information disclosure in WWBN AVideo through version 30.0 exposes user registration statistics via two unprotected PHP endpoints. The report4.json.php and report4.1.json.php files return daily and cumulative user-registration counts to any remote requester without authentication or session validation. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog; however, its trivial exploitation path and network accessibility make it easy for any actor who can reach the server to enumerate platform growth data.
RemediationAI
The primary remediation is to apply the fix described in the GitHub security advisory at https://github.com/WWBN/AVideo/security/advisories/GHSA-xv5m-gpmp-m72c; no specific patched version number was confirmed in available data, so administrators should verify the installed release exceeds version 30.0 and addresses this issue directly. As an immediate workaround, web-server-level deny rules targeting the paths report4.json.php and report4.1.json.php - via nginx deny directives or Apache mod_rewrite - will block unauthenticated access, with the trade-off that any internal dashboard or automation relying on these endpoints will cease to function. A less disruptive alternative is IP allowlisting at the reverse-proxy layer to restrict these endpoints to trusted internal network ranges only, which preserves legitimate reporting functionality while eliminating external exposure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WWBN AVideo is an open-source PHP-based video streaming and community platform. The affected components are a pair of JSON reporting endpoints - report4.json.php and report4.1.json.php - that lack any authentication or authorization middleware, violating the principle of least privilege. The root cause maps directly to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the application returns operational data without verifying that the requester holds a valid session or appropriate role. The CPE cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:* confirms all releases through version 30.0 are affected, with no lower version bound specified in available data.
Know when Avideo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Network-accessible with no authentication or user interaction required; confidentiality impact is Low as only aggregate registration counts are disclosed, with no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
WWBN AVideo through version 30.0 fails to enforce authentication on the report4.json.php and report4.1.json.php endpoints, allowing unauthenticated access to user registration statistics. Attackers can send GET requests to these endpoints to retrieve daily and cumulative user-registration counts without any session or authorization.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
A cross-site scripting (xss) vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.
An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath
A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit
An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed
Unauthenticated SQL injection in AVideo before 24.0.
OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbit
A reflected cross-site scripting (xss) vulnerability exists in the charts tab selection functionality of WWBN AVideo 11.
A cross-site scripting (xss) vulnerability exists in the channelBody.php user name functionality of WWBN AVideo 11.6 and
A cross-site scripting (xss) vulnerability exists in the videoAddNew functionality of WWBN AVideo 11.6 and dev master co
An insufficient entropy vulnerability exists in the userRecoverPass.php recoverPass generation functionality of WWBN AVi
WWBN AVideo is an open source video platform. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable
AVideo is an open source video platform. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low
Exploit-DB