CVE-2026-35449CWE-200

WWBN AVideo has Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.php

Medium · published April 6, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
26.3
In the wild
Unconfirmed
What it is

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the install/test.php diagnostic script has its CLI-only access guard disabled by commenting out the die() statement. The script remains accessible via HTTP after installation, exposing video viewer statistics including IP addresses, session IDs, and user agents to unauthenticated visitors.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00341 · 26.3th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-04-06T21:46Z
EPSS history
Timeline
  • 06 APR 21:46Z
    WWBN AVideo has Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.php
    cvelistv5