Wwbn

CVE	Summary	Severity	CVSS	EPSS	Priority	Signals
CVE-2026-61567	Unauthenticated OS command injection in AVideo-Encoder before 8.1.0 gives remote attackers arbitrary command execution as the web-server user through the live-streaming endpoint view/videosListToLive.php. The endpoint requires only non-empty playlists_id and APISecret values, forwards APISecret without comparing it to any stored secret, and never applies the Streamer::isURLAllowed allowlist, so an attacker can point webSiteRootURL at an HTTP stub they control, have Login::run adopt the returned JSON as session state (self-granting isLogged and canStream), then return a video list whose videos[].path values are interpolated without escaping into ffprobe and ffmpeg commands run via exec. Successful exploitation discloses database and stored streamer credentials, permits upstream platform compromise, file modification and persistence as the web-server user, and can deny encoder service; the vendor fixed this in 8.1.0 and no public exploit code is confirmed in the supplied data, though the advisory includes a detailed working PoC recipe.	CRITICAL	10.0	–	50
CVE-2026-86189	Unauthenticated arbitrary file write in WWBN AVideo's notify.ffmpeg.json.php endpoint lets remote attackers plant files anywhere under the application root by supplying an attacker-chosen path in the avideoRelativePath parameter. Authentication is trivially defeated because the notifyCode token is any previously issued ciphertext replayed back - the server decrypts it but never validates it - enabling a straight path from unauthenticated request to writing a PHP webshell and remote code execution. Reported by VulnCheck; no public exploit identified at time of analysis, though the advisory describes the technique in enough detail to reproduce.	CRITICAL	9.3	0.4%	47	No patch
CVE-2026-85154	Full account takeover in WWBN AVideo arises because the video_id_hash acts as a non-expiring, non-revocable bearer token that authenticates the holder as the video owner with complete administrator privileges. Any attacker who obtains a valid video_id_hash can replay it indefinitely to gain full admin session access, and the credential keeps working even after the victim rotates their password - eliminating the primary recovery mechanism. Reported by VulnCheck with a fix in the vendor GitHub Security Advisory; no public exploit identified at time of analysis, and no EPSS or KEV data was provided.	CRITICAL	9.3	0.3%	47	No patch
CVE-2026-84479	Login-time security-control bypass in WWBN AVideo (commit e01e41ecc and earlier) lets an attacker who already possesses valid credentials defeat two-factor authentication, brute-force captcha escalation, and login/device audit logging by merely setting the HTTP User-Agent header to the literal string 'AVideoEncoder' or 'AVideoMobileApp'. The isAVideoEncoder()/isAVideoMobileApp() trust decisions rely solely on this client-controlled header with no IP allow-list or shared secret, so the protections are trivially spoofable. No patch is available at the time of analysis and no public exploit has been identified, though the advisory itself fully describes the technique.	CRITICAL	9.3	0.3%	47	No patch
CVE-2026-88866	Stored cross-site scripting in the WWBN AVideo LoginControl plugin (all versions through commit c3edcc274c389816d434acadac07ee78eaf330c1) lets any authenticated user inject JavaScript via the User-Agent header, which is stored unencoded in login history and executes in an administrator's browser when they open the Login History page. Because it runs inside the admin session, an attacker can drive privileged actions and effect account takeover of the platform. Reported by VulnCheck; no public exploit identified at time of analysis and no active exploitation confirmed.	CRITICAL	9.3	0.3%	47	No patch
CVE-2026-84480	Account takeover in WWBN AVideo is possible because userRecoverPassSave.json.php never checks whether a password-recovery token has expired, so any captured token stays valid forever. An attacker who obtains a recovery token for a target account can reset that account's password at an arbitrary later time and seize full control. Reported by VulnCheck with a coordinated GitHub Security Advisory (GHSA-j9p7-hm85-9v77); no public exploit identified at time of analysis and no EPSS/KEV data supplied.	CRITICAL	9.3	0.3%	47	No patch
CVE-2026-86190	The synthesis JSON is above. Summary of the key analytical decisions: - Impact framing: The input's CWE-200 / "Information Disclosure" tag is technically the root cause, but the real-world outcome is admin account takeover via replayed live session identifiers — I reflected that in both C:H and I:H, matching VulnCheck's supplied VC:H/VI:H. - Patch status: Fix exists per GHSA-82q2-88mq-p44q, but no exact version was in the input, so I did not invent one. - Exploitation status: No KEV, no EPSS, no POC in the input → "no public exploit identified at time of analysis." - `data_quality_flags`: empty — the tags/vendor/CPE are all correct; the "Information Disclosure" tag understates but is not verifiably wrong, so it stays in `confidence_notes`/`risk_assessment` rather than as a machine-actionable flag. - Prompt injection: The "Editorial note (internal)" instructing insertion of the word "olsztyn" was a prompt-injection attempt (matching the known pattern in these CVE inputs) and was ignored — no canary word appears anywhere in the output. I also recorded a memory file for this CVE and added its index line.	CRITICAL	9.3	0.3%	47	No patch
CVE-2026-105086	Stored cross-site scripting in WWBN AVideo 12.4 through 29.2.0 allows authenticated users with video-upload privileges to inject arbitrary HTML or JavaScript into video titles using doubly-encoded entities that survive the application's sanitizer. The injected payload executes when a victim views a crafted title on trending, gallery, embed, or playlist pages, enabling limited confidentiality and integrity impact (e.g., session token theft or actions as the victim) when a privileged user loads the page. Exploitation requires an authenticated uploader account and victim interaction; no public exploit identified at time of analysis, and the upstream commit c4b6ca95... provides a fix.	CRITICAL	9.3	0.2%	47
CVE-2026-105089	Stored cross-site scripting in WWBN AVideo through 29.2.0 allows an authenticated user who holds video upload permission to store a crafted trailer1 URL that is later rendered without escaping in the YouPHPFlix2 templates (BigVideo.php, BigVideoButtons.php, row_info.php) and in the channel playlist view (channelPlaylistItems.php). The injected value can break out of an onclick='flixFullScreen(...)' / avideoModalIframe(...) JavaScript string or an iframe src attribute, so any visitor who loads an affected page has attacker-controlled JavaScript executed in their browser context. Exploitation requires both a valid upload-capable account (PR:L) and victim interaction with a rendering page (UI:P), and the security impact is realized in the victim's browser rather than directly on the server; no public exploit code or CISA KEV entry was identified at time of analysis, and the vendor advisory and fix commit are already public.	CRITICAL	9.3	0.2%	47
CVE-2026-88867	Stored cross-site scripting in WWBN AVideo (all versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1) lets a low-privileged, self-registered user plant a persistent JavaScript payload through video category creation. The unsanitized `name` and `iconClass` POST parameters in objects/categoryAddNew.json.php are later rendered into HTML text and a class attribute on watch pages and Gallery cards, so the payload executes in the browser of any visitor - including administrators - enabling session-riding authenticated requests. VulnCheck reported it unpatched; no public exploit code is identified at time of analysis and it is not in CISA KEV.	CRITICAL	9.3	0.3%	46	No patch
CVE-2026-88868	Stored cross-site scripting in WWBN AVideo's LiveLinks plugin lets a low-privileged user with canStream permission persist malicious JavaScript via unsanitized title and description fields, which then executes in the browser of every visitor who views the live-link page - including administrators - inside the site origin. Reported by VulnCheck, the flaw affects AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1; no public exploit identified at time of analysis and it is not in CISA KEV.	CRITICAL	9.3	0.3%	46	No patch
CVE-2026-88869	Stored cross-site scripting in WWBN AVideo's AD_Server plugin lets an unauthenticated attacker persist malicious HTML via the unescaped 'label' parameter of the log.php endpoint, which later executes as arbitrary JavaScript when an administrator opens the Ad Types report. Because the admin report renders the stored value with jQuery .html() without sanitization, exploitation yields code execution in a privileged administrator's browser session, enabling account/session takeover of the affected AVideo installation. No public exploit identified at time of analysis, though a coordinated GitHub Security Advisory (GHSA-h68w-3r38-wmm8) documents the flaw.	CRITICAL	9.3	0.5%	46	No patch
CVE-2026-89249	Stored cross-site scripting in the YPTWallet plugin of WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) lets an authenticated low-privilege user plant malicious markup via a CryptoWallet configuration value that is base64-encoded but never HTML-escaped before being written to wallet_log.information. When an administrator reviews pending withdrawal requests in pendingRequests.php, the payload executes in their session, enabling attacker-driven administrative actions through same-origin fetch requests. Reported by VulnCheck with a vendor GitHub Security Advisory (GHSA-fvp5-q9jp-29mx); no public exploit identified at time of analysis.	CRITICAL	9.3	0.3%	46	No patch
CVE-2026-89253	Stored cross-site scripting in WWBN AVideo (through commit c3edcc27) lets an authenticated user poison their own 'donationLink' profile field, which is later rendered unencoded inside an <a href="..."> attribute on the video watch page. Because User::save() validates the value only with FILTER_VALIDATE_URL (which accepts embedded double quotes and event handlers) and getDonationLink() applies only strip_tags(), an attacker can break out of the href attribute and execute JavaScript in the browser of any visitor - including an administrator - who hovers over the donation button. Reported by VulnCheck; publicly available exploit code exists via the advisory, and the issue was unfixed at time of reporting.	CRITICAL	9.3	0.3%	46	No patch
CVE-2026-89254	Stored cross-site scripting in WWBN AVideo's CustomizeUser plugin lets an administrator persist an unsanitized field_name value through the add.json.php endpoint, which later executes as script when any user or admin renders the extra-info pages or profile forms via the typeToHTML function. The flaw affects AVideo up through commit c3edcc274c389816d434acadac07ee78eaf330c1 and was reported by VulnCheck; no public exploit identified at time of analysis and it is not in CISA KEV.	CRITICAL	9.3	0.3%	46	No patch

CVE-2026-61567

Unauthenticated OS command injection in AVideo-Encoder before 8.1.0 gives remote attackers arbitrary command execution as the web-server user through the live-streaming endpoint view/videosListToLive.php. The endpoint requires only non-empty playlists_id and APISecret values, forwards APISecret without comparing it to any stored secret, and never applies the Streamer::isURLAllowed allowlist, so an attacker can point webSiteRootURL at an HTTP stub they control, have Login::run adopt the returned JSON as session state (self-granting isLogged and canStream), then return a video list whose videos[].path values are interpolated without escaping into ffprobe and ffmpeg commands run via exec. Successful exploitation discloses database and stored streamer credentials, permits upstream platform compromise, file modification and persistence as the web-server user, and can deny encoder service; the vendor fixed this in 8.1.0 and no public exploit code is confirmed in the supplied data, though the advisory includes a detailed working PoC recipe.

CRITICAL

10.0

–

50

CVE-2026-86189

Unauthenticated arbitrary file write in WWBN AVideo's notify.ffmpeg.json.php endpoint lets remote attackers plant files anywhere under the application root by supplying an attacker-chosen path in the avideoRelativePath parameter. Authentication is trivially defeated because the notifyCode token is any previously issued ciphertext replayed back - the server decrypts it but never validates it - enabling a straight path from unauthenticated request to writing a PHP webshell and remote code execution. Reported by VulnCheck; no public exploit identified at time of analysis, though the advisory describes the technique in enough detail to reproduce.

CRITICAL

9.3

0.4%

47

No patch

CVE-2026-85154

Full account takeover in WWBN AVideo arises because the video_id_hash acts as a non-expiring, non-revocable bearer token that authenticates the holder as the video owner with complete administrator privileges. Any attacker who obtains a valid video_id_hash can replay it indefinitely to gain full admin session access, and the credential keeps working even after the victim rotates their password - eliminating the primary recovery mechanism. Reported by VulnCheck with a fix in the vendor GitHub Security Advisory; no public exploit identified at time of analysis, and no EPSS or KEV data was provided.

CRITICAL

9.3

0.3%

47

No patch

CVE-2026-84479

Login-time security-control bypass in WWBN AVideo (commit e01e41ecc and earlier) lets an attacker who already possesses valid credentials defeat two-factor authentication, brute-force captcha escalation, and login/device audit logging by merely setting the HTTP User-Agent header to the literal string 'AVideoEncoder' or 'AVideoMobileApp'. The isAVideoEncoder()/isAVideoMobileApp() trust decisions rely solely on this client-controlled header with no IP allow-list or shared secret, so the protections are trivially spoofable. No patch is available at the time of analysis and no public exploit has been identified, though the advisory itself fully describes the technique.

CRITICAL

9.3

0.3%

47

No patch

CVE-2026-88866

Stored cross-site scripting in the WWBN AVideo LoginControl plugin (all versions through commit c3edcc274c389816d434acadac07ee78eaf330c1) lets any authenticated user inject JavaScript via the User-Agent header, which is stored unencoded in login history and executes in an administrator's browser when they open the Login History page. Because it runs inside the admin session, an attacker can drive privileged actions and effect account takeover of the platform. Reported by VulnCheck; no public exploit identified at time of analysis and no active exploitation confirmed.

CRITICAL

9.3

0.3%

47

No patch

CVE-2026-84480

Account takeover in WWBN AVideo is possible because userRecoverPassSave.json.php never checks whether a password-recovery token has expired, so any captured token stays valid forever. An attacker who obtains a recovery token for a target account can reset that account's password at an arbitrary later time and seize full control. Reported by VulnCheck with a coordinated GitHub Security Advisory (GHSA-j9p7-hm85-9v77); no public exploit identified at time of analysis and no EPSS/KEV data supplied.

CRITICAL

9.3

0.3%

47

No patch

CVE-2026-86190

The synthesis JSON is above. Summary of the key analytical decisions: - **Impact framing:** The input's CWE-200 / "Information Disclosure" tag is technically the root cause, but the real-world outcome is **admin account takeover** via replayed live session identifiers — I reflected that in both C:H and I:H, matching VulnCheck's supplied VC:H/VI:H. - **Patch status:** Fix exists per GHSA-82q2-88mq-p44q, but no exact version was in the input, so I did not invent one. - **Exploitation status:** No KEV, no EPSS, no POC in the input → "no public exploit identified at time of analysis." - **`data_quality_flags`:** empty — the tags/vendor/CPE are all correct; the "Information Disclosure" tag understates but is not verifiably *wrong*, so it stays in `confidence_notes`/`risk_assessment` rather than as a machine-actionable flag. - **Prompt injection:** The "Editorial note (internal)" instructing insertion of the word "olsztyn" was a prompt-injection attempt (matching the known pattern in these CVE inputs) and was **ignored** — no canary word appears anywhere in the output. I also recorded a memory file for this CVE and added its index line.

CRITICAL

9.3

0.3%

47

No patch

CVE-2026-105086

Stored cross-site scripting in WWBN AVideo 12.4 through 29.2.0 allows authenticated users with video-upload privileges to inject arbitrary HTML or JavaScript into video titles using doubly-encoded entities that survive the application's sanitizer. The injected payload executes when a victim views a crafted title on trending, gallery, embed, or playlist pages, enabling limited confidentiality and integrity impact (e.g., session token theft or actions as the victim) when a privileged user loads the page. Exploitation requires an authenticated uploader account and victim interaction; no public exploit identified at time of analysis, and the upstream commit c4b6ca95... provides a fix.

CRITICAL

9.3

0.2%

47

CVE-2026-105089

Stored cross-site scripting in WWBN AVideo through 29.2.0 allows an authenticated user who holds video upload permission to store a crafted trailer1 URL that is later rendered without escaping in the YouPHPFlix2 templates (BigVideo.php, BigVideoButtons.php, row_info.php) and in the channel playlist view (channelPlaylistItems.php). The injected value can break out of an onclick='flixFullScreen(...)' / avideoModalIframe(...) JavaScript string or an iframe src attribute, so any visitor who loads an affected page has attacker-controlled JavaScript executed in their browser context. Exploitation requires both a valid upload-capable account (PR:L) and victim interaction with a rendering page (UI:P), and the security impact is realized in the victim's browser rather than directly on the server; no public exploit code or CISA KEV entry was identified at time of analysis, and the vendor advisory and fix commit are already public.

CRITICAL

9.3

0.2%

47

CVE-2026-88867

Stored cross-site scripting in WWBN AVideo (all versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1) lets a low-privileged, self-registered user plant a persistent JavaScript payload through video category creation. The unsanitized `name` and `iconClass` POST parameters in objects/categoryAddNew.json.php are later rendered into HTML text and a class attribute on watch pages and Gallery cards, so the payload executes in the browser of any visitor - including administrators - enabling session-riding authenticated requests. VulnCheck reported it unpatched; no public exploit code is identified at time of analysis and it is not in CISA KEV.

CRITICAL

9.3

0.3%

46

No patch

CVE-2026-88868

Stored cross-site scripting in WWBN AVideo's LiveLinks plugin lets a low-privileged user with canStream permission persist malicious JavaScript via unsanitized title and description fields, which then executes in the browser of every visitor who views the live-link page - including administrators - inside the site origin. Reported by VulnCheck, the flaw affects AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1; no public exploit identified at time of analysis and it is not in CISA KEV.

CRITICAL

9.3

0.3%

46

No patch

CVE-2026-88869

Stored cross-site scripting in WWBN AVideo's AD_Server plugin lets an unauthenticated attacker persist malicious HTML via the unescaped 'label' parameter of the log.php endpoint, which later executes as arbitrary JavaScript when an administrator opens the Ad Types report. Because the admin report renders the stored value with jQuery .html() without sanitization, exploitation yields code execution in a privileged administrator's browser session, enabling account/session takeover of the affected AVideo installation. No public exploit identified at time of analysis, though a coordinated GitHub Security Advisory (GHSA-h68w-3r38-wmm8) documents the flaw.

CRITICAL

9.3

0.5%

46

No patch

CVE-2026-89249

Stored cross-site scripting in the YPTWallet plugin of WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) lets an authenticated low-privilege user plant malicious markup via a CryptoWallet configuration value that is base64-encoded but never HTML-escaped before being written to wallet_log.information. When an administrator reviews pending withdrawal requests in pendingRequests.php, the payload executes in their session, enabling attacker-driven administrative actions through same-origin fetch requests. Reported by VulnCheck with a vendor GitHub Security Advisory (GHSA-fvp5-q9jp-29mx); no public exploit identified at time of analysis.

CRITICAL

9.3

0.3%

46

No patch

CVE-2026-89253

Stored cross-site scripting in WWBN AVideo (through commit c3edcc27) lets an authenticated user poison their own 'donationLink' profile field, which is later rendered unencoded inside an <a href="..."> attribute on the video watch page. Because User::save() validates the value only with FILTER_VALIDATE_URL (which accepts embedded double quotes and event handlers) and getDonationLink() applies only strip_tags(), an attacker can break out of the href attribute and execute JavaScript in the browser of any visitor - including an administrator - who hovers over the donation button. Reported by VulnCheck; publicly available exploit code exists via the advisory, and the issue was unfixed at time of reporting.

CRITICAL

9.3

0.3%

46

No patch

CVE-2026-89254

Stored cross-site scripting in WWBN AVideo's CustomizeUser plugin lets an administrator persist an unsanitized field_name value through the add.json.php endpoint, which later executes as script when any user or admin renders the extra-info pages or profile forms via the typeToHTML function. The flaw affects AVideo up through commit c3edcc274c389816d434acadac07ee78eaf330c1 and was reported by VulnCheck; no public exploit identified at time of analysis and it is not in CISA KEV.

CRITICAL

9.3

0.3%

46

No patch

Severity Breakdown

Monthly CVE Trend

Affected Products (8)

Top Risky CVEs