WWBN AVideo

Published Atomicorp research notes for CVEs affecting WWBN AVideo where WAF protections were observed during testing or engineering review.

These notes are not intended to represent the full set of vulnerabilities mitigated by Atomicorp products and should not be interpreted as a coverage matrix, certification list, or census of protected CVEs.

Atomicorp WAF protections are primarily designed around attack techniques and exploit behaviors rather than individual vulnerability identifiers. A published research note documents a positive research finding related to that CVE. If a CVE is absent from these notes, no conclusion should be drawn about protection status.

CVEVulnerabilityCVSSSeverityRules Observed
CVE-2026-64625AVideo before 29.0 OS Command Injection via execAsync9.3 (v4.0)Critical340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655
CVE-2026-86189WWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg.json.php9.3 (v4.0)Critical340007 , 344360 , 390709
CVE-2026-88866WWBN AVideo LoginControl Stored XSS via User-Agent Header9.3 (v4.0)Critical333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148
CVE-2026-88867WWBN AVideo Stored XSS via Category Name and Icon Class9.3 (v4.0)Critical333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148
CVE-2026-88868AVideo LiveLinks Stored XSS via title and description fields9.3 (v4.0)Critical333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755
CVE-2026-88869AVideo AD_Server Stored XSS via log.php label parameter9.3 (v4.0)Critical333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2026-89249AVideo YPTWallet Stored XSS via CryptoWallet Configuration9.3 (v4.0)Critical333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148
CVE-2026-89253AVideo Stored XSS via donationLink in watch page button9.3 (v4.0)Critical333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148
CVE-2026-89254AVideo CustomizeUser Stored XSS via field_name Parameter9.3 (v4.0)Critical333140 , 333141 , 340095 , 340147 , 341256 , 342259 , 346755
CVE-2026-89255AVideo LoginControl Stored XSS via PGP Public Key9.3 (v4.0)Critical333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2026-89256AVideo Bookmark Plugin Stored XSS via Chapter Names9.3 (v4.0)Critical333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148
CVE-2026-63304AVideo through 29.0 OS Command Injection via listFFmpegProcesses9.2 (v4.0)Critical340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655
CVE-2026-63305AVideo through 29.0 OS Command Injection via ffmpeg.json.php9.2 (v4.0)Critical340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655
CVE-2026-89243WWBN AVideo Stored XSS via UserGroups setGroup_name9.2 (v4.0)Critical333140 , 333141 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 350147 , 350148
CVE-2026-45578WWBN AVideo Live: OS command injection in on_publish.php execAsync via unescaped m3u8 URL8.8 (v3.1)High340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655
CVE-2026-84208AVideo User_Location Plugin Unauthenticated SQL Injection8.7 (v4.0)High340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572
CVE-2026-85155WWBN AVideo SQL Injection via get.json.php APIName channels8.7 (v4.0)High340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572
CVE-2026-89250WWBN AVideo Unauthenticated File Read via getRecordedFile.php8.7 (v4.0)High340007 , 344360 , 347009 , 390709
CVE-2026-39369WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLs7.6 (v3.1)High340007 , 344360 , 390709
CVE-2026-85160AVideo through c91b5975d CSRF and Path Traversal via stopLive.php7.2 (v4.0)High340007 , 344360 , 347009 , 390709
CVE-2026-39370WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltr7.1 (v3.1)High337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022
CVE-2026-85163AVideo Server-Side Request Forgery via epg_link parameter7.1 (v4.0)High337109 , 337110 , 340162 , 340163 , 344360 , 398001 , 398008 , 398021 , 398022
CVE-2026-85164WWBN AVideo Server-Side Request Forgery via set_api_userImages7.1 (v4.0)High337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398001 , 398021 , 398022
CVE-2026-45731WWBN AVideo: Authenticated Arbitrary File Read in view/update.php6.9 (v4.0)Medium340007 , 344360 , 390709
CVE-2026-46337WWBN AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in view/img/image404Raw.php6.9 (v4.0)Medium340007 , 344360 , 347009 , 390709
CVE-2026-81678AVideo SSRF Guard Bypass via IPv6 Transition Addresses6.9 (v4.0)Medium337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022
CVE-2026-86188AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting6.9 (v4.0)Medium333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2026-89242WWBN AVideo Unauthenticated SSRF via login.json.php6.9 (v4.0)Medium337109 , 337110 , 398022
CVE-2026-34740AVideo: Stored SSRF via Video EPG Link Missing isSSRFSafeURL() Validation6.5 (v3.1)Medium337109 , 337110 , 344360 , 398021 , 398022
CVE-2026-39368WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services6.5 (v3.1)Medium337109 , 337110 , 344360 , 398021 , 398022
CVE-2022-32770WWBN AVideo 11.6 - Cross-Site Scripting6.1 (v3.1)Medium333140 , 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2022-32771WWBN AVideo 11.6 - Cross-Site Scripting6.1 (v3.1)Medium333140 , 340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2022-32772WWBN AVideo 11.6 - Cross-Site Scripting6.1 (v3.1)Medium333140 , 340147 , 341266 , 342259
CVE-2023-48728WWBN AVideo 11.6 - Cross-Site Scripting6.1 (v3.1)Medium340147 , 340148 , 341245 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2026-34396AVideo: Stored XSS via Unescaped Plugin Configuration Values in Admin Panel6.1 (v3.1)Medium333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 , 350147 , 350148
CVE-2026-34739AVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.php6.1 (v3.1)Medium333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2026-45580WWBN AVideo Live: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute5.4 (v3.1)Medium333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148
CVE-2026-64626AVideo Encoder downloadURL SSRF via unpinned retry fallback5.3 (v4.0)Medium337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022
CVE-2026-82646WWBN AVideo Unauthenticated Reflected XSS via url2Embed.json.php5.3 (v4.0)Medium333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2026-85158AVideo Reflected XSS via videoEmbeded.php link parameter5.3 (v4.0)Medium333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2026-85159AVideo Reflected XSS via cancelUri in userLogin.php5.3 (v4.0)Medium333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2026-85577AVideo userLogin.php Reflected XSS via error parameter5.3 (v4.0)Medium333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755
CVE-2026-89240WWBN AVideo Reflected XSS via confirmLivePassword.php5.3 (v4.0)Medium333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2026-89241WWBN AVideo Reflected XSS via confirmLivePassword.php5.3 (v4.0)Medium333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2026-89244WWBN AVideo Reflected XSS via Gallery Category getBackURL5.3 (v4.0)Medium333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2026-89247WWBN AVideo XML Injection via plugin/AD_Server/VMAP.php5.3 (v4.0)Medium330791 , 340152 , 341256 , 344360 , 344370 , 344372 , 344373 , 347009 , 350147 , 380018
CVE-2026-72747AVideo Stored Cross-Site Scripting via Unauthenticated Registration5.1 (v4.0)Medium333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148
CVE-2026-84477AVideo Stored XSS via Live Schedule Title Description5.1 (v4.0)Medium333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755
CVE-2026-89148AVideo Open Redirect via playlistSort.php Referer Header5.1 (v4.0)Medium340162 , 340163 , 340165 , 344365