Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the BlockonomicsYPT plugin's check.php endpoint returns payment order data for any Bitcoin address without requiring authentication. The endpoint was designed as an AJAX polling helper for the authenticated invoice.php page, but it performs no access control checks of its own. Since Bitcoin addresses are publicly visible on the blockchain, an attacker can query payment records for any address used on the platform.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-35448 Unauthenticated Information Disclosure in WWBN AVideo BlockonomicsYPT Plugin 26.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-35448
Post summary
The post discloses CVE‑2026‑35448, describing an unauthenticated information disclosure in WWBN AVideo BlockonomicsYPT Plugin 26.0, with no evidence of exploits, patches, or active attacks.
CVE-2026-35448 WWBN AVideo is an open source video platform. In versions 26.0 and prior, the BlockonomicsYPT plugin's check.php endpoint returns payment order data for any Bitcoin a… https://www.cve.org/CVERecord?id=CVE-2026-35448
Post summary
The text announces CVE‑2026‑35448, noting that older AVideo versions expose payment order data via the BlockonomicsYPT plugin’s check.php endpoint, but provides no PoC, exploit code, or patch details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | wwbn | avideo | - | - | - |