CVE-2026-30885
Medium · 5.3CVSS
5.3
EPSS
0.4%
Published
Mar 10, 2026
CISA due date
—
The record
WWBN AVideo is an open source video platform. Prior to 25.0, the /objects/playlistsFromUser.json.php endpoint returns all playlists for any user without requiring authentication or authorization. An unauthenticated attacker can enumerate user IDs and retrieve playlist information including playlist names, video IDs, and playlist status for any user on the platform. This vulnerability is fixed in 25.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | wwbn/avideo | 0 | 25.0 |
Related vulnerabilities
- GHSA-6w2r-cfpc-23r5 AVideo has Unauthenticated IDOR - Playlist Information Disclosure Same vulnerability
- CVE-2026-29058 AVideo is a video-sharing Platform software. Also affects wwbn/avideo
- CVE-2026-28501 WWBN AVideo is an open source video platform. Also affects wwbn/avideo
- CVE-2026-28502 WWBN AVideo is an open source video platform. Also affects wwbn/avideo
- CVE-2026-29093 WWBN AVideo is an open source video platform. Also affects wwbn/avideo
- GHSA-xxpw-32hf-q8v9 AVideo: Unauthenticated PHP session store exposed to host network via published memcached… Also affects wwbn/avideo
- GHSA-9j26-99jh-v26q WWBN AVideo is vulnerable to unauthenticated OS Command Injection via base64Url in… Also affects wwbn/avideo
- GHSA-v8jw-8w5p-23g3 AVideo has Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction Also affects wwbn/avideo