CVE-2026-34732 - Vulnerability Analysis

Overview

WWBN AVideo <= 26.0 contains an information disclosure vulnerability caused by missing authentication and authorization checks in the CreatePlugin list.json.php template, letting unauthenticated attackers access sensitive data, exploit requires no authentication.

Severity & Score

Impact

Unauthenticated attackers can access sensitive user and system data, risking privacy breaches and data exposure.

Mitigation

Update to the latest version once patches are available or implement authentication checks on list.json.php endpoints.

References

• https://github.com/WWBN/AVideo/security/advisories/GHSA-g2mg-cgr6-vmv7

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner