CVE-2026-39370

WWBN AVideo is an open source video platform that, in versions up to 29.0, allows unauthenticated users to read APISecret from objects/plugins.json.php. This enables them to call protected API endpoints, such as users_list, without logging in.

WWBN AVideo versions 29.0 and below are vulnerable to OS command injection. The fix for CVE-2026-33482 was incomplete and does not neutralize a single & (shell background operator), allowing multiple commands to be chained.

In WWBN AVideo prior to version 29.0, a vulnerability in the Authorize.Net webhook handler allows an attacker to bypass signature verification and forge webhook requests with arbitrary payment amounts and target user IDs. The attacker can credit arbitrary wallet balances to any user without a corresponding payment and activate premium subscriptions, leading to free access to paid content and direct revenue loss.

A privilege escalation vulnerability in WWBN AVideo prior to version 29.0 allows any user who can solve a CAPTCHA to self-grant elevated permissions during registration via unguarded API parameters. Attackers can mark accounts as email-verified and obtain upload, streaming, and meeting creation rights.

In WWBN AVideo version 29.0 and earlier, the endpoint plugin/AuthorizeNet/processPayment.json.php credits the user's wallet based solely on the attacker-controlled amount parameter, without validating any Authorize.Net transaction. This allows any logged-in user to add arbitrary funds to their AVideo wallet.

WWBN AVideo in version 29.0 and earlier stores category descriptions from user input and renders them as raw HTML in the Gallery view. A user who can create or edit categories can store JavaScript in a category description, which executes when another user views the affected page. This is a stored XSS vulnerability in the category description field.

WWBN AVideo is an open source video platform. In 29.0 and earlier, an unauthenticated remote attacker can read arbitrary image files anywhere on disk that the PHP user can open — including private user-profile photos that the application's normal serving wrappers gate behind ACLs, admin-uploaded thumbnails, encrypted-video poster frames, and image content under sibling-app directories reachable via .. traversal. The endpoint requires no authentication.

In WWBN AVideo (version 29.0 and earlier), view/update.php reads $_POST['updateFile'] as a relative path under updatedb/ and passes it to PHP's file() for line-by-line execution as part of a database migration. An authenticated administrator can abuse this to read arbitrary text files reachable from the web-server process.

In WWBN AVideo 29.0 and earlier, the file objects/mention.json.php lacks authentication checks or an admin gate. It only has a simple entry guard: preg_match('/^@/', $_REQUEST['term']) and a hard-coded rowCount=10. This allows unauthenticated user enumeration.

WWBN AVideo in version 29.0 and earlier does not use the $resolvedIP out-param of isSSRFSafeURL() for DNS pinning via CURLOPT_RESOLVE in EpgParser.php, plugin/AI/receiveAsync.json.php, and other locations. This opens a DNS-rebinding TOCTOU vulnerability.