WWBN AVideo
Published Atomicorp research notes for CVEs affecting WWBN AVideo where WAF protections were observed during testing or engineering review.
These notes are not intended to represent the full set of vulnerabilities mitigated by Atomicorp products and should not be interpreted as a coverage matrix, certification list, or census of protected CVEs.
Atomicorp WAF protections are primarily designed around attack techniques and exploit behaviors rather than individual vulnerability identifiers. A published research note documents a positive research finding related to that CVE. If a CVE is absent from these notes, no conclusion should be drawn about protection status.
| CVE | Vulnerability | CVSS | Severity | Rules Observed |
|---|---|---|---|---|
| CVE-2026-40911 | WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side | 10.0 (v3.1) | Critical | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-28501 | AVideo Unauthenticated SQL Injection Credential Dump | 9.8 (v3.1) | Critical | 340145 , 340156 , 341145 , 341245 |
| CVE-2026-105086 | WWBN AVideo 12.4 through 29.2.0 Stored XSS via Double-Encoded Video Title | 9.3 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-105089 | WWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHPFlix2 Templates | 9.3 (v4.0) | Critical | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-41064 | AVideo has an incomplete fix for CVE-2026-33502 (Command Injection) | 9.3 (v3.1) | Critical | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-64625 | AVideo before 29.0 OS Command Injection via execAsync | 9.3 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |
| CVE-2026-86189 | WWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg.json.php | 9.3 (v4.0) | Critical | 340007 , 344360 , 390709 |
| CVE-2026-88866 | WWBN AVideo LoginControl Stored XSS via User-Agent Header | 9.3 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-88867 | WWBN AVideo Stored XSS via Category Name and Icon Class | 9.3 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-88868 | AVideo LiveLinks Stored XSS via title and description fields | 9.3 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-88869 | AVideo AD_Server Stored XSS via log.php label parameter | 9.3 (v4.0) | Critical | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-89249 | AVideo YPTWallet Stored XSS via CryptoWallet Configuration | 9.3 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-89253 | AVideo Stored XSS via donationLink in watch page button | 9.3 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-89254 | AVideo CustomizeUser Stored XSS via field_name Parameter | 9.3 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 341256 , 342259 , 346755 |
| CVE-2026-89255 | AVideo LoginControl Stored XSS via PGP Public Key | 9.3 (v4.0) | Critical | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-89256 | AVideo Bookmark Plugin Stored XSS via Chapter Names | 9.3 (v4.0) | Critical | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-63304 | AVideo through 29.0 OS Command Injection via listFFmpegProcesses | 9.2 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-63305 | AVideo through 29.0 OS Command Injection via ffmpeg.json.php | 9.2 (v4.0) | Critical | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-89243 | WWBN AVideo Stored XSS via UserGroups setGroup_name | 9.2 (v4.0) | Critical | 333140 , 333141 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34374 | AVideo has SQL Injection in Live_schedule::keyExists() via Unparameterized Stream Key | 9.1 (v3.1) | Critical | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-41304 | WWBN AVideo vulnerable to RCE caused by clonesite plugin | 8.9 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-45578 | WWBN AVideo Live: OS command injection in on_publish.php execAsync via unescaped m3u8 URL | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-84208 | AVideo User_Location Plugin Unauthenticated SQL Injection | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-85155 | WWBN AVideo SQL Injection via get.json.php APIName channels | 8.7 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-89250 | WWBN AVideo Unauthenticated File Read via getRecordedFile.php | 8.7 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-92580 | AVideo through 29.0 CloneSite Stored Shell Injection via SSH Password CSRF | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 341245 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-34375 | AVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment Page | 8.2 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-55173 | AVideo incomplete fix for CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving | 8.1 (v3.1) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-43884 | WWBN AVideo: SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL() | 7.7 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-39369 | WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLs | 7.6 (v3.1) | High | 340007 , 344360 , 390709 |
| CVE-2026-43874 | WWBN AVideo: Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via | 7.2 (v3.1) | High | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2026-85160 | AVideo through c91b5975d CSRF and Path Traversal via stopLive.php | 7.2 (v4.0) | High | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-33767 | AVideo has SQL Injection via Partial Prepared Statement — videos_id Concatenated Directly into Query | 7.1 (v4.0) | High | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-39370 | WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltr | 7.1 (v3.1) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-85163 | AVideo Server-Side Request Forgery via epg_link parameter | 7.1 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-85164 | WWBN AVideo Server-Side Request Forgery via set_api_userImages | 7.1 (v4.0) | High | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398001 , 398021 , 398022 |
| CVE-2025-34441 | AVideo notify.ffmpeg.json.php Unauthenticated RCE via Salt Discovery | 6.9 (v4.0) | Medium | 340128 , 380018 , 390801 |
| CVE-2025-34442 | AVideo notify.ffmpeg.json.php Unauthenticated RCE via Salt Discovery | 6.9 (v4.0) | Medium | 340128 , 380018 , 390801 |
| CVE-2026-116800 | WWBN AVideo before 29.5.0 Local PHP File Inclusion via Accept-Language Header | 6.9 (v4.0) | Medium | 340006 , 390719 |
| CVE-2026-45731 | WWBN AVideo: Authenticated Arbitrary File Read in view/update.php | 6.9 (v4.0) | Medium | 340007 , 344360 , 390709 |
| CVE-2026-46337 | WWBN AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in view/img/image404Raw.php | 6.9 (v4.0) | Medium | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-81678 | AVideo SSRF Guard Bypass via IPv6 Transition Addresses | 6.9 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-86188 | AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting | 6.9 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-89242 | WWBN AVideo Unauthenticated SSRF via login.json.php | 6.9 (v4.0) | Medium | 337109 , 337110 , 398022 |
| CVE-2026-91966 | AVideo through 29.0 Unauthenticated SSRF via Host Header | 6.9 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-34740 | AVideo: Stored SSRF via Video EPG Link Missing isSSRFSafeURL() Validation | 6.5 (v3.1) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-39368 | WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services | 6.5 (v3.1) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-40909 | WWBN AVideo has a Path Traversal in Locale Save Endpoint that Enables Arbitrary PHP File Write to Any Web-Accessible Dir | 6.5 (v3.1) | Medium | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-41060 | AVideo's SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL | 6.5 (v3.1) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-41062 | WWBN/AVideo has an incomplete fix for a directory traversal bypass via query string in ReceiveImage downloadURL paramete | 6.5 (v3.1) | Medium | 340007 , 344360 , 390709 |
| CVE-2022-32770 | WWBN AVideo 11.6 - Cross-Site Scripting | 6.1 (v3.1) | Medium | 333140 , 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-32771 | WWBN AVideo 11.6 - Cross-Site Scripting | 6.1 (v3.1) | Medium | 333140 , 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-32772 | WWBN AVideo 11.6 - Cross-Site Scripting | 6.1 (v3.1) | Medium | 333140 , 340147 , 341266 , 342259 |
| CVE-2023-48728 | WWBN AVideo 11.6 - Cross-Site Scripting | 6.1 (v3.1) | Medium | 340147 , 340148 , 341245 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34396 | AVideo: Stored XSS via Unescaped Plugin Configuration Values in Admin Panel | 6.1 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34739 | AVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.php | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-43878 | WWBN AVideo: Reflected XSS in plugin/Meet/iframe.php via Unescaped user/pass Parameters Reflected into JavaScript St | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-50182 | AVideo Has Unauthenticated Reflected XSS via $_GET['search'] in YouTubeAPI Gallery Pagination | 6.1 (v3.1) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 , 390585 |
| CVE-2026-41061 | WWBN AVideo Vulnerable to stored XSS via Unanchored Duration Regex in Video Encoder Receiver | 5.4 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-41063 | WWBN AVideo has incomplete fix for CVE-2026-33500 (XSS) | 5.4 (v3.1) | Medium | 333140 , 333141 , 342259 |
| CVE-2026-45580 | WWBN AVideo Live: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute | 5.4 (v3.1) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-114634 | WWBN AVideo before 29.4.0 Blind SSRF via getHeaderContentTypeFromURL Redirect | 5.3 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-33766 | AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints | 5.3 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-56347 | AVideo TopMenu Plugin - Stored Cross-Site Scripting via Unescaped Menu Item Fields | 5.3 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-64626 | AVideo Encoder downloadURL SSRF via unpinned retry fallback | 5.3 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-82646 | WWBN AVideo Unauthenticated Reflected XSS via url2Embed.json.php | 5.3 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-85158 | AVideo Reflected XSS via videoEmbeded.php link parameter | 5.3 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-85159 | AVideo Reflected XSS via cancelUri in userLogin.php | 5.3 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-85577 | AVideo userLogin.php Reflected XSS via error parameter | 5.3 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-89240 | WWBN AVideo Reflected XSS via confirmLivePassword.php | 5.3 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-89241 | WWBN AVideo Reflected XSS via confirmLivePassword.php | 5.3 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-89244 | WWBN AVideo Reflected XSS via Gallery Category getBackURL | 5.3 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-89247 | WWBN AVideo XML Injection via plugin/AD_Server/VMAP.php | 5.3 (v4.0) | Medium | 330791 , 340152 , 341256 , 344360 , 344370 , 344372 , 344373 , 347009 , 350147 , 380018 |
| CVE-2026-91967 | AVideo through 29.0 Blind SSRF via getHeaderContentTypeFromURL | 5.3 (v4.0) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-92584 | AVideo through 29.0 Stored Cross-Site Scripting via User-Agent Header | 5.3 (v4.0) | Medium | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-100630 | AVideo Stored XSS via HTML Entity Bypass in trailer1 Field | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-116139 | WWBN AVideo 26.0 through 29.3.0 Stored XSS via Comment Markdown Rendering | 5.1 (v4.0) | Medium | 333140 , 333141 , 340147 , 340148 , 342259 , 350147 , 350148 |
| CVE-2026-72747 | AVideo Stored Cross-Site Scripting via Unauthenticated Registration | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-84477 | AVideo Stored XSS via Live Schedule Title Description | 5.1 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-89148 | AVideo Open Redirect via playlistSort.php Referer Header | 5.1 (v4.0) | Medium | 340162 , 340163 , 340165 , 344365 |