CVE-2026-35449
WWBN AVideo has Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.php
Vexday Risk Score
13Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 5.3EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
06 abr 2026Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the install/test.php diagnostic script has its CLI-only access guard disabled by commenting out the die() statement. The script remains accessible via HTTP after installation, exposing video viewer statistics including IP addresses, session IDs, and user agents to unauthenticated visitors.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Productos afectados
WWBN · AVideo¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →