https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 18:12:01 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-323070 EUVD-2026-323070 https://cve.radiocsirt.org/vuln/euvd-2026-323070 https://cve.radiocsirt.org/vuln/fkie_cve-2026-45620 <p>WWBN AVideo is an open source video platform. In 29.0 and earlier, objects/mention.json.php has no User::loginCheck() or admin gate. It only has an entry guard: preg_match(&#39;/^@/&#39;, $_REQUEST[&#39;term&#39;]) and hard-coded rowCount=10. This enables unauthenticated user enumeration.</p> <p>WWBN AVideo is an open source video platform. In 29.0 and earlier, objects/mention.json.php has no User::loginCheck() or admin gate. It only has an entry guard: preg_match(&#39;/^@/&#39;, $_REQUEST[&#39;term&#39;]) and hard-coded rowCount=10. This enables unauthenticated user enumeration.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-45620 https://cve.radiocsirt.org/vuln/ghsa-vpfx-pxqw-2w79 <p><strong>Affected:</strong> Packagist: WWBN/AVideo</p> <p>CVE-2026-43881 fix `d9cdc7024` patched `users.json.php` only. The same anti-pattern survives at master HEAD in:</p> <p>``` objects/mention.json.php:17 $ignoreAdmin = true; objects/mention.json.php:18 $users = User::getAllUsers($ignoreAdmin, [&#39;name&#39;, &#39;email&#39;, &#39;user&#39;, &#39;channelName&#39;], &#39;a&#39;); ```</p> <p>No `User::loginCheck()`, no admin gate. Only entry guard: `preg_match(&#39;/^@/&#39;, $_REQUEST[&#39;term&#39;])` and hard-coded `rowCount=10`.</p> <p><strong>Affected:</strong> Packagist: WWBN/AVideo</p> <p>CVE-2026-43881 fix `d9cdc7024` patched `users.json.php` only. The same anti-pattern survives at master HEAD in:</p> <p>``` objects/mention.json.php:17 $ignoreAdmin = true; objects/mention.json.php:18 $users = User::getAllUsers($ignoreAdmin, [&#39;name&#39;, &#39;email&#39;, &#39;user&#39;, &#39;channelName&#39;], &#39;a&#39;); ```</p> <p>No `User::loginCheck()`, no admin gate. Only entry guard: `preg_match(&#39;/^@/&#39;, $_REQUEST[&#39;term&#39;])` and hard-coded `rowCount=10`.</p> https://cve.radiocsirt.org/vuln/ghsa-vpfx-pxqw-2w79