CVE-2026-114633Medium· 6.5▾ SunlitWWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts to delete or modify administrator accounts. Attackers can submit requests to confirmDeleteUser.json.php or userAddNew.…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 23.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts to delete or modify administrator accounts. Attackers can submit requests to confirmDeleteUser.json.php or userAddNew.json.php targeting administrators to delete their videos and accounts, or change and demote them.
AVideo < 29.4.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116800Medium· 6.2WWBN AVideo before 29.5.0 Local PHP File Inclusion via Accept-Language Header
CVE-2026-116139Medium· 5.4WWBN AVideo 26.0 through 29.3.0 Stored XSS via Comment Markdown Rendering
CVE-2026-114634Medium· 4.3WWBN AVideo before 29.4.0 Blind SSRF via getHeaderContentTypeFromURL Redirect
CVE-2026-114048Low· 3.5WWBN AVideo before 24.0 CSRF via Legacy Playlist and Video Endpoints
CVE-2026-60092Medium· 6.1AVideo (Meet plugin) through commit e8d6119f3cb1b849149906efeb0a41fc024f59f8 contains a stored cross-site scripting vulnerability in the Meet plugin's getMeetInfo.json.php endpoint
CVE-2026-105089High· 8.7WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 URL