Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

WWBN — Vulnerabilities & Security Advisories 329

Browse all 329 CVE security advisories affecting WWBN. AI-powered Chinese analysis, POCs, and references for each vulnerability.

WWBN operates as a provider of web-based business solutions, primarily focusing on content management and e-commerce platforms that enable organizations to manage digital assets and online transactions. Historically, its software has been susceptible to a wide array of critical vulnerabilities, including Remote Code Execution (RCE), Cross-Site Scripting (XSS), and SQL Injection, often stemming from insufficient input validation and outdated dependencies. These flaws have frequently allowed attackers to escalate privileges, execute arbitrary commands, or exfiltrate sensitive data. The high volume of recorded Common Vulnerabilities and Exposures (CVEs) indicates persistent security challenges within the codebase, reflecting difficulties in maintaining rigorous patch management and secure coding practices over time. Consequently, organizations deploying WWBN solutions face significant risks if they do not implement robust network segmentation and timely updates to mitigate these known attack vectors.

Top products by WWBN: AVideo AVideo-Encoder
CVE ID Title CVSS Severity Published
CVE-2026-81678 AVideo SSRF Guard Bypass via IPv6 Transition Addresses — AVideo CWE-918 7.5 High 2026-08-27
CVE-2026-59808 AVideo Authentication Bypass via Unkeyed Video Hash Disclosure — AVideo CWE-306 8.8 High 2026-08-22
CVE-2026-59256 WWBN AVideo Unbound Token Authorization Bypass via Gallery — AVideo CWE-200 7.5 High 2026-08-22
CVE-2026-58003 WWBN AVideo Cross-Site Request Forgery via releaseVideoNow.json.php — AVideo CWE-352 7.1 High 2026-08-22
CVE-2026-58002 WWBN AVideo Authorization Bypass via Users_affiliations add.json.php — AVideo CWE-345 6.5 Medium 2026-08-22
CVE-2026-58001 WWBN AVideo Cross-Site Request Forgery via videoEditLight.php — AVideo CWE-352 5.7 Medium 2026-08-22
CVE-2026-57944 AVideo channelToGallery.json.php Cross-Site Request Forgery — AVideo CWE-352 5.4 Medium 2026-08-22
CVE-2026-56380 AVideo feed/index.php Exposure of Channel Owner Email Address — AVideo CWE-200 5.3 Medium 2026-08-22
CVE-2026-72748 AVideo Unauthenticated Arbitrary File Write via aVideoEncoderChunk.json.php — AVideo CWE-306 9.1 Critical 2026-08-11
CVE-2026-72747 AVideo Stored Cross-Site Scripting via Unauthenticated Registration — AVideo CWE-79 7.2 High 2026-08-11
CVE-2026-64626 AVideo Encoder downloadURL SSRF via unpinned retry fallback — AVideo CWE-918 6.4 Medium 2026-07-20
CVE-2026-64625 AVideo before 29.0 OS Command Injection via execAsync — AVideo CWE-78 9.8 Critical 2026-07-20
CVE-2026-33731 AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data — AVideo CWE-345 6.5 Medium 2026-07-16
CVE-2026-55173 AVideo incomplete fix for CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command execution at the same execAsync sh -c sink — AVideo CWE-78 8.1 High 2026-07-16
CVE-2026-33692 AVideo Has Unauthenticated .env File Exposure via Official Docker Compose Configuration — AVideo CWE-20 7.5 High 2026-07-16
CVE-2026-63305 AVideo through 29.0 OS Command Injection via ffmpeg.json.php — AVideo CWE-78 8.1 High 2026-07-16
CVE-2026-63304 AVideo through 29.0 OS Command Injection via listFFmpegProcesses — AVideo CWE-78 8.1 High 2026-07-16
CVE-2026-54458 AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin — AVideo CWE-79 9.6 Critical 2026-07-15
CVE-2026-50183 WWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery Section — AVideo CWE-79 4.7 Medium 2026-07-15
CVE-2026-50182 AVideo Has Unauthenticated Reflected XSS via $_GET['search'] in YouTubeAPI Gallery Pagination — AVideo CWE-79 6.1 Medium 2026-07-15
CVE-2026-49279 WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass) — AVideo CWE-79 - - 2026-07-15
CVE-2026-33684 AVideo's Privilege AVideo: Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet Permissions — AVideo CWE-862 5.3 Medium 2026-07-15
CVE-2026-56347 AVideo TopMenu Plugin - Stored Cross-Site Scripting via Unescaped Menu Item Fields — AVideo CWE-79 6.1 Medium 2026-06-20
CVE-2026-45580 WWBN AVideo Live: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute — AVideo CWE-79 5.4 Medium 2026-05-29
CVE-2026-45578 WWBN AVideo Live: OS command injection in on_publish.php execAsync via unescaped m3u8 URL — AVideo CWE-78 8.8 High 2026-05-29
CVE-2026-45610 WWBN AVideo plugin/LoginControl/set.json.php: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA — AVideo CWE-306 5.7 Medium 2026-05-29
CVE-2026-45619 AVideo CVE-2026-43884 incomplete fix - `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD post — AVideo CWE-367 6.5 Medium 2026-05-29
CVE-2026-45620 AVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumeration — AVideo CWE-204 5.3 Medium 2026-05-29
CVE-2026-45731 WWBN AVideo: Authenticated Arbitrary File Read in view/update.php — AVideo CWE-22 - - 2026-05-29
CVE-2026-46337 WWBN AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php` — AVideo CWE-22 - - 2026-05-29

This page lists every published CVE security advisory associated with WWBN. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.