Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2741▼ 480 respecto a la semana anterior
Críticas / altas1308▼ 182 respecto a la semana anterior
Nueva explotación activa (KEV)3▼ 5 respecto a la semana anterior
Sin puntuar (sin CVSS)226▼ 276 respecto a la semana anterior
356 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Modificada | Media (6.1) | 0.40% | — | Wwbn Avideo | 25/4/2023 | 17/6/2026 | Cross Site Scripting (XSS) vulnerability in World Wide Broadcast Network AVideo before 12.4, allows attackers to gain sensitive information via the success parameter to /user. | |
| Modificada | Crítica (9.8) | 1.3% | — | Wwbn Avideo | 25/4/2023 | 17/6/2026 | OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbitrary code via the video link field to the Embed a video link feature. | |
| Modificada | Alta (8.8) | 1.1% | — | Wwbn Avideo | 22/8/2022 | 17/6/2026 | A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the Live Schedules plugin, allowing an… | |
| Modificada | Alta (8.8) | 1.9% | — | Wwbn Avideo | 22/8/2022 | 17/6/2026 | A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the CloneSite plugin, allowing an… | |
| Modificada | Alta (8.8) | 1.2% | — | Wwbn Avideo | 22/8/2022 | 17/6/2026 | A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the Live Schedules plugin, allowing an… | |
| Modificada | Alta (8.8) | 1.9% | — | Wwbn Avideo | 22/8/2022 | 17/6/2026 | A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the aVideoEncoder functionality which can… | |
| Modificada | Alta (7.5) | 2.4% | — | Wwbn Avideo | 22/8/2022 | 17/6/2026 | An information disclosure vulnerability exists in the cookie functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. The session cookie and the pass cookie miss the HttpOnly flag, making them accessible via JavaScript. The session cookie also misses the secure flag, which allows the session cookie to be… | |
| Modificada | Alta (7.5) | 2.4% | — | Wwbn Avideo | 22/8/2022 | 17/6/2026 | An information disclosure vulnerability exists in the cookie functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. The session cookie and the pass cookie miss the HttpOnly flag, making them accessible via JavaScript. The session cookie also misses the secure flag, which allows the session cookie to be… | |
| Modificada | Media (6.1) | 4.0% | 💥 Exploit | Wwbn Avideo | 22/8/2022 | 17/6/2026 | A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger this… | |
| Modificada | Media (6.1) | 4.2% | 💥 Exploit | Wwbn Avideo | 22/8/2022 | 17/6/2026 | A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger this… | |
| Modificada | Media (6.1) | 4.4% | 💥 Exploit | Wwbn Avideo | 22/8/2022 | 17/6/2026 | A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger this… | |
| Modificada | Media (5) | 0.80% | — | Wwbn Avideo | 22/8/2022 | 17/6/2026 | Multiple authentication bypass vulnerabilities exist in the objects id handling functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request by an authenticated user can lead to unauthorized access and takeover of resources. An attacker can send an HTTP request to trigger this… | |
| Modificada | Media (4.2) | 0.92% | — | Wwbn Avideo | 22/8/2022 | 17/6/2026 | Multiple authentication bypass vulnerabilities exist in the objects id handling functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request by an authenticated user can lead to unauthorized access and takeover of resources. An attacker can send an HTTP request to trigger this… | |
| Modificada | Media (6.5) | 2.8% | — | Wwbn Avideo | 22/8/2022 | 17/6/2026 | An information disclosure vulnerability exists in the aVideoEncoderReceiveImage functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary file read. An attacker can send an HTTP request to trigger this vulnerability. | |
| Modificada | Alta (8.8) | 24% | — | Wwbn Avideo | 22/8/2022 | 17/6/2026 | An os command injection vulnerability exists in the aVideoEncoder wget functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability. | |
| Modificada | Alta (8.8) | 1.8% | — | Wwbn Avideo | 22/8/2022 | 17/6/2026 | An improper password check exists in the login functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. An attacker that owns a users' password hash will be able to use it to directly login into the account, leading to increased privileges. | |
| Modificada | Media (6.1) | 84% | — | Wwbn Avideo | 22/8/2022 | 17/6/2026 | A cross-site scripting (xss) vulnerability exists in the image403 functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability. | |
| Modificada | Alta (8.8) | 4.9% | — | Wwbn Avideo | 22/8/2022 | 17/6/2026 | A privilege escalation vulnerability exists in the session id functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to increased privileges. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability. | |
| Modificada | Crítica (9.9) | 64% | — | Wwbn Avideo | 22/8/2022 | 17/6/2026 | A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability. | |
| Modificada | Alta (8.8) | 75% | — | Wwbn Avideo | 22/8/2022 | 17/6/2026 | An OS command injection vulnerability exists in the aVideoEncoder chunkfile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability. | |
| Modificada | Alta (8.8) | 1.7% | — | Wwbn Avideo | 22/8/2022 | 17/6/2026 | A cross-site request forgery (CSRF) vulnerability exists in WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to increased privileges. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability. | |
| Modificada | Crítica (9) | 3.1% | — | Wwbn Avideo | 22/8/2022 | 17/6/2026 | A cross-site scripting (xss) vulnerability exists in the videoAddNew functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability. | |
| Modificada | Media (6.5) | 2.7% | — | Wwbn Avideo | 22/8/2022 | 17/6/2026 | An information disclosure vulnerability exists in the chunkFile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary file read. An attacker can send an HTTP request to trigger this vulnerability. | |
| Modificada | Crítica (9.6) | 3.9% | — | Wwbn Avideo | 22/8/2022 | 17/6/2026 | A reflected cross-site scripting (xss) vulnerability exists in the charts tab selection functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger this… | |
| Modificada | Media (6.1) | 0.64% | — | Wwbn Avideo | 5/4/2022 | 17/6/2026 | Open redirect vulnerability in objects/login.json.php in WWBN AVideo through 11.6, allows attackers to arbitrarily redirect users from a crafted url to the login page. |