Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2026-90541

WWBN AVideo Unauthenticated Information Disclosure via menus.json.php

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to require authentication in the plugin/TopMenu/menus.json.php endpoint, allowing unauthenticated attackers to retrieve all menu data. Attackers can send GET requests to the endpoint to read inactive and admin-only menu names that are not displayed in the public navbar.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WWBN AVideo

Default version status: unaffected

  • 0 to ≤ c3edcc274c389816d434acadac07ee78eaf330c1affected

References