Wwbn's vulnerability footprint concentrates in a narrowly scoped product line centered on video hosting and encoding infrastructure, yet the vendor ranks among the most prominent in the landscape, reflecting the critical role these applications play in content delivery and media management. Vulnerabilities affecting the vendor skew toward serious outcomes, with an elevated share reaching critical severity and a moderate tendency toward public exploit availability. The exposure recurs consistently across the AVideo and AVideo Encoder products through application-layer weakness classes including cross-site scripting, missing authorization, server-side request forgery, cross-site request forgery, and path traversal—a pattern reflective of web application input handling and access-control challenges in media-processing software. Defenders should prioritize patching of this vendor's releases, particularly for internet-exposed instances, and inventory deployments carefully given the severity profile; current exploitation activity and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Wwbn over time
Signals from CVEs in this vendor scope (197 CVEs).
197 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-30534HIGH An OS command injection vulnerability exists in the aVideoEncoder chunkfile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can l | Aug 22, 2022 | 8.8 | 70 | NO | NO |
CVE-2022-30690MEDIUM A cross-site scripting (xss) vulnerability exists in the image403 functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arb | Aug 22, 2022 | 6.1 | 66 | NO | NO |
CVE-2022-30547CRITICAL A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbi | Aug 22, 2022 | 9.9 | 66 | NO | NO |
CVE-2026-33478CRITICAL WWBN AVideo is an open source video platform. In versions up to and including 26.0, multiple vulnerabilities in AVideo's CloneSite plugin chain together to allow a completely unaut | Mar 23, 2026 | 10.0 | 54 | NO | YES |
CVE-2024-31819CRITICAL An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath parameter of the submitIndex.php component. | Apr 10, 2024 | 9.8 | 49 | NO | YES |
CVE-2026-28501CRITICAL WWBN AVideo is an open source video platform. Prior to version 24.0, an unauthenticated SQL Injection vulnerability exists in AVideo within the objects/videos.json.php and objects/ | Mar 6, 2026 | 9.8 | 48 | NO | YES |
CVE-2026-29058CRITICAL AVideo is a video-sharing Platform software. Prior to version 7.0, an unauthenticated attacker can execute arbitrary OS commands on the server by injecting shell command substituti | Mar 6, 2026 | 9.8 | 47 | NO | YES |
CVE-2026-64625CRITICAL AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync() re-wraps escaped commands in double-quoted sh -c, allowing command substitution via $() and backt | Jul 20, 2026 | 9.8 | 43 | NO | NO |
CVE-2025-34442HIGH AVideo versions prior to 20.1 disclose absolute filesystem paths via multiple public API endpoints. Returned metadata includes full server paths to media files, revealing underlyin | Dec 17, 2025 | 7.5 | 39 | NO | YES |
CVE-2025-34441HIGH AVideo versions prior to 20.1 expose sensitive user information through an unauthenticated public API endpoint. Responses include emails, usernames, administrative status, and last | Dec 17, 2025 | 7.5 | 39 | NO | YES |
Signals from CVEs in this vendor scope (197 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Wwbn.
Media articles that mention a CVE ID that affects a product developed by Wwbn — matched by CVE ID, not by vendor name.