CVE-2026-81732CWE-200information-disclosure

CVE-2026-81732

published August 28, 2026

CVSS
6.9
EPSS
1%
Percentile
45.8
In the wild
Unconfirmed
What it is

WWBN AVideo through version 30.0 fails to enforce authentication on the report4.json.php and report4.1.json.php endpoints, allowing unauthenticated access to user registration statistics. Attackers can send GET requests to these endpoints to retrieve daily and cumulative user-registration counts without any session or authorization.

The record
Technical detail
CVSS
6.9 · NONE
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00559 · 45.8th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-08-28T16:16Z
References (3)
https://github.com/WWBN/AVideo/security/advisories/GHSA-xv5m-gpmp-m72c · [email protected]https://www.vulncheck.com/advisories/wwbn-avideo-through-30.0-information-disclosure-via-report4-json-php · [email protected]https://github.com/WWBN/AVideo/security/advisories/GHSA-xv5m-gpmp-m72c · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 30 AUG 16:19Z
    EPSS moved — → 0%
    epss
  • 28 AUG 10:49Z
    WWBN AVideo through 30.0 Information Disclosure via report4.json.php
    cvelistv5