CVE WATCH / VULNERABILITY DETAIL
CVE-2026-126804
HIGHCVSS 8.1NVD feed
Published 11 November 2026 · tracked since 12 November 2026
Description
WWBN AVideo 12.4 through 29.7.1 contains a path traversal vulnerability in the ADs plugin deleteImage.json.php that allows authenticated users with custom ads to delete arbitrary files. Attackers can set the unvalidated is_regular_user parameter to another user's id or ../ sequences to delete other
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-126184 HIGH 8.2
- CVE-2026-126183 HIGH 8.7
- CVE-2026-126181 HIGH 8
- CVE-2026-126180 HIGH 8.4
- CVE-2026-126177 HIGH 8.1
- CVE-2026-126176 HIGH 8.1
- CVE-2026-126175 HIGH 8.8
- CVE-2026-126170 CRITICAL 9.8
- CVE-2026-126165 HIGH 7.5
- CVE-2026-126164 CRITICAL 9.4