CVE-2026-90541 — WWBN AVideo Unauthenticated Information Disclosure via menus.json.php
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to require authentication in the plugin/TopMenu/menus.json.php endpoint, allowing unauthenticated attac…
Published: 2026-09-12 · CVSS: 6.9 · CVSS 4.0
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to require authentication in the plugin/TopMenu/menus.json.php endpoint, allowing unauthenticated attackers to retrieve all menu data. Attackers can send GET requests to the endpoint to read inactive and admin-only menu names that are not displayed in the public navbar.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7