CVE-2026-90544 in AVideo
Сводка
по MITRE • 12.09.2026
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the videoAddViewCount.json.php endpoint before updating view statistics. Authenticated attackers can increment view counts and watch-time on videos they cannot access by submitting requests with arbitrary video IDs.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.