CVE-2026-90537 - WWBN AVideo Scheduler sendEmail Missing Authorization via Token
Brief
CVE ID : CVE-2026-90537
Published : Sept. 12, 2026, 1:16 p. m.
- 7 hours, 36 minutes ago
Description : WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/Scheduler/sendEmail. json. php that allows unauthenticated attackers to access scheduler email jobs by providing a site-wide daily token.
Attackers can enumerate scheduler jobs, read private live titles and email addresses, and trigger email sending by supplying any valid daily token obtained from Live pages.
Severity: 8.8
- HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...