ЗаражениеИдея пересекает среды: подтверждённый мем-мост или широкая география на фоне роста.ЗатухаетИнтерес спадает: объём упоминаний снижается.региональноеЗначимость (1–5): 1 — локальная рутина, 2 — регионально заметное, 3 — национально значимое, 4 — резонанс в нескольких странах, 5 — глобальное событие.ТехнологииИсправить тему — ваша правка попадёт в обучающие данные4scoreScore 0–100 — композитная оценка виральности: рост объёма упоминаний (35%), ускорение (15%), число независимых источников (20%), географический разброс (15%) и новизна темы (15%). Подробнее — ADR-0004.выше, чем у 0% активных трендов
CVE-2026-84480 (CRITICAL): WWBN AVideo не проверяет истечение срока действия токена восстановления пароля в userRecoverPassSave.json.php, позволяя злоумышленникам использовать истекшие токены для сброса пароля учетной записи
Идея пересекает среды: подтверждённый мем-мост или широкая география на фоне роста.
Пункт tech-выпуска:
- Документов:
- 14
- Источник:
- 1
- Впервые замечен:
- 1 сент., 23:17 UTC
- Последняя активность:
- 17 сент., 13:17 UTC
✦ Сгенерировано ИИпо документам кластера
Для этого тренда объяснение ещё не сгенерировано.
Нажмите «Обновить объяснение», чтобы запросить его у модели.
Документы-источники
14подтверждено источником- 1nvd.nist.govпозавчера17 сент., 13:17 UTC
CVE-2026-92918 (HIGH): admin3 through 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events. Attackers with log:view permission can ↗
admin3 through 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events. Attackers with log:view permission can read the JSON response from the GET /logs endpoint to harvest session tokens and replay them as bearer credentials for full user access.
- 2nvd.nist.govпозавчера17 сент., 12:18 UTC
CVE-2026-92915 (HIGH): WWBN AVideo through commit e01e41ecc (no patched version available) contains a broken access control flaw in objects/userVerifyEmail.php. The script disables th ↗
WWBN AVideo through commit e01e41ecc (no patched version available) contains a broken access control flaw in objects/userVerifyEmail.php. The script disables the login requirement ($global['ignoreUserMustBeLoggedIn'] = 1), takes users_id directly from the query string, and calls User::sendVerificationLink() with no session requirement, no CSRF/global token, no relationship check between caller and target, and no enforceRateLimit() call. The only intended throttle is keyed to the caller's own ses
- 3nvd.nist.govпозавчера17 сент., 12:18 UTC
CVE-2026-92914 (HIGH): AVideo LoginControl contains an authentication bypass vulnerability in the PGP second factor verification that compares challenge responses using loose equality ↗
AVideo LoginControl contains an authentication bypass vulnerability in the PGP second factor verification that compares challenge responses using loose equality against an uninitialized session variable. Attackers with a victim's password can bypass the second factor by sending a parameter-less GET request to verifyChallenge.json.php, which evaluates null == null and marks authentication complete.
- 4nvd.nist.govпозавчера17 сент., 12:18 UTC
CVE-2026-92913 (HIGH): AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 uses a cryptographically weak pseudo-random number generator when creating account activation / l ↗
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 uses a cryptographically weak pseudo-random number generator when creating account activation / login pairing codes. getRandomCode() in objects/functions.php derives the code entirely from uniqid() (sprintf('%08x%05x', seconds, microseconds)) with a single non-CSPRNG rand() character used only as padding, reducing the code space to roughly 36 x 10^6 (~2^25) values for a known generation second. Because plugin/API/set.json.php?APIName
- 5nvd.nist.gov14 дней назад5 сент., 13:18 UTC
CVE-2026-86190 (CRITICAL): WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery to ↗
WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery tokens, and live session identifiers to unauthenticated callers when a hash parameter is provided. Attackers can use the disclosed session identifier to hijack viewer sessions, including administrator accounts, and obtain sensitive personal data for all video viewers.
- 6nvd.nist.gov14 дней назад5 сент., 13:18 UTC
CVE-2026-86189 (CRITICAL): WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by sup ↗
WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by supplying a caller-chosen path in the avideoRelativePath parameter. Attackers can replay any previously issued ciphertext as a notifyCode token, which is decrypted but never validated, to bypass authentication and write files to the application root and subdirectories.
- 7nvd.nist.gov14 дней назад5 сент., 13:18 UTC
CVE-2026-86188 (HIGH): AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other u ↗
AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other users' browsers via the websocket callback mechanism. Attackers can send crafted socket messages with callback names resolving to global functions like avideoConfirmHTML that accept untrusted data and assign it to innerHTML, achieving script execution in the victim's origin without authentication or user interaction.
- 8nvd.nist.gov16 дней назад3 сент., 13:06 UTC
CVE-2026-85164 (HIGH): WWBN AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the set_api_userImages API endpoint that fails to validate profileI ↗
WWBN AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the set_api_userImages API endpoint that fails to validate profileImg and backgroundImg URLs before fetching them. Authenticated API clients can supply internal URLs to fetch cloud metadata or internal services, with responses written to publicly accessible web paths for retrieval.
- 9nvd.nist.gov16 дней назад3 сент., 13:06 UTC
CVE-2026-85160 (HIGH): AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php that allows attackers to delete directori ↗
AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php that allows attackers to delete directories by exploiting missing token validation and unsanitized key parameter concatenation. Attackers can craft an image tag with a traversal payload like key=../../videos to trigger recursive deletion of the videos directory when an admin visits a malicious page.
- 10nvd.nist.gov16 дней назад3 сент., 13:06 UTC
CVE-2026-85155 (HIGH): WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php endpoint with APIName=channels that allows unauthenticated a ↗
WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php endpoint with APIName=channels that allows unauthenticated attackers to order results by arbitrary database columns including users.password and users.recoverPass. Attackers can exploit this ordering oracle to infer password hash values and recovery tokens, and trigger SQL errors that disclose the full query statement and database schema.
- 11nvd.nist.gov16 дней назад3 сент., 13:06 UTC
CVE-2026-85154 (CRITICAL): WWBN AVideo contains an authentication failure vulnerability where the video_id_hash credential is a non-expiring, non-revocable bearer token that grants full a ↗
WWBN AVideo contains an authentication failure vulnerability where the video_id_hash credential is a non-expiring, non-revocable bearer token that grants full administrator session access to the video owner's account. Attackers who obtain a video_id_hash can replay it indefinitely to authenticate as the video owner with full privileges, and the credential remains valid even after the owner changes their password.
- 12nvd.nist.gov18 дней назад1 сент., 23:17 UTC
CVE-2026-84480 (CRITICAL): WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account pass ↗
WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account passwords indefinitely. Attackers who obtain a recovery token can use it at any time to change the target account's password and gain full account access.
- 13nvd.nist.gov18 дней назад1 сент., 23:17 UTC
CVE-2026-84478 (HIGH): WWBN AVideo contains a path traversal vulnerability in the API get_api_login_code endpoint that allows unauthenticated attackers to delete arbitrary .log files ↗
WWBN AVideo contains a path traversal vulnerability in the API get_api_login_code endpoint that allows unauthenticated attackers to delete arbitrary .log files by supplying directory traversal sequences in the code parameter. Attackers can exploit this to destroy audit logs and probe for file existence on the server, with the vulnerability enabling both file deletion and information disclosure about the filesystem.
- 14nvd.nist.gov18 дней назад1 сент., 23:17 UTC
CVE-2026-84476 (HIGH): WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers to spoof the client address used by enf ↗
WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers to spoof the client address used by enforceRateLimit(). Attackers can rotate the header value per request to bypass login rate limiting and perform unlimited credential guessing attacks.
Объём упоминаний по часамUTC
Уже стало мемоминтернет отреагировал картинками — связь найдена автоматически
⌖ Deep Researchпроверено по веб-источникам
Глубокое исследование строится на поиске по вебу: модель находит внешние публикации и сверяет с ними факты. Базовое объяснение выше опирается только на документы кластера.
Глубокое исследование для этого тренда ещё не проводилось.
Нажмите «Объяснить подробнее» — модель поищет контекст в веб-источниках. Обычно это занимает 1–2 минуты.
Кто освещаетраспределение источников — наблюдение, не оценкаразнообразие 17/100
Языкиen100%
Доменыnvd.nist.gov100%
Считается по документам этого тренда. Страна источника — не позиция источника; агрегаторы могут размывать происхождение. Методология: нормированная энтропия по доменам, странам и языкам.
Ключевые сущностикто и что упоминается — клик покажет все тренды с этой сущностью
- 🏛️HIGH10Организация · 10 упом. · показать все тренды
- 🏷️WWBN AVideo9Прочее · 9 упом. · показать все тренды
- 👤Attackers8Персона · 8 упом. · показать все тренды
- 🏛️WWBN4Организация · 4 упом. · показать все тренды
- 🏛️GET2Организация · 2 упом. · показать все тренды
- enforceRateLimit