AVideo Platform 8.1 contains an information disclosure vulnerability that allows attackers to enumerate user details through the playlistsFromUser.json.php endpoint. Attackers can retrieve sensitive user information including email, password hash, and administrative status by manipulating the users_id parameter.
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XWwbn Avideo
APPWwbn8.1
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
Related vulnerabilities
CVE-2026-41064CRITICAL9.3PL ✓same product
WWBN AVideo — niekompletna naprawa command injection w test.php
CVE-2026-40911CRITICAL10.0PL ✓same product
WWBN AVideo: RCE przez eval() w pluginie YPTSocket — przejęcie kont
CVE-2026-33867CRITICAL9.1PL ✓same product
WWBN AVideo: hasła do filmów przechowywane w bazie jako plaintext
CVE-2026-34374CRITICAL9.1PL ✓same product
SQL Injection w WWBN AVideo — mechanizm uwierzytelniania RTMP
CVE-2026-33351CRITICAL9.1PL ✓same product
SSRF w WWBN AVideo — brak walidacji parametru URL w saveDVR.json.php