{"items":[{"id":"NVI-00007332","kind":"vulnerability","title":"AVideo: Unauthenticated Access to Payment Order Data via BlockonomicsYPT check.php","revision":3,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-3v7m-qg4x-58h9","CVE-2026-35448"],"plain_summary":"OSV carries this publisher advisory for wwbn/avideo. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-2df6a4ec4ffc29c7a5769c2d8e954881"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-24T21:10:00.143Z","value":"3.7 LOW (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-6d901d67cf4e2e94661eb99936ada810"},{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"0.318%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.24823. Missing scores are unknown.","source_id":"sr-2df6a4ec4ffc29c7a5769c2d8e954881"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-d7af1e4cdeaa664116b85397dbb7c0b4","url":"https://github.com/advisories/GHSA-3v7m-qg4x-58h9","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-3v7m-qg4x-58h9","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:49.660Z"},{"id":"sr-6d901d67cf4e2e94661eb99936ada810","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35448","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-35448","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-01T07:23:23.484Z"},{"id":"sr-2df6a4ec4ffc29c7a5769c2d8e954881","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-35448","publisher":"FIRST EPSS","observed_at":"2026-10-31T22:06:15.377Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-d7af1e4cdeaa664116b85397dbb7c0b4"],"technology":"wwbn/avideo","known_exclusions":[],"conditions_summary":"## Summary\n\nThe BlockonomicsYPT plugin's `check.php` endpoint returns payment order data for any Bitcoin address without requiring authentication. The endpoint was designed as an AJAX polling helper for the authenticated `invoice.php` page, but it performs no access control checks of its own. Since Bitcoin addresses are publicly visible on the blockchain, an attacker can query payment records for any address used on the platform.\n\n## Details\n\nIn `plugin/BlockonomicsYPT/check.php` at lines 20-30, the endpoint accepts a Bitcoin address and returns the corresponding order data:\n\n```php\n$addr = $_GET['addr'];\n$order = new BlockonomicsOrder(0);\n$obj = $order->getFromAddressFromDb($addr);\ndie(json_encode($obj));\n```\n\nThere is no authentication check. The endpoint does not verify that the requesting user is logged in, nor does it verify that the requesting user owns the order associated with the given address.\n\nThe response includes:\n- User ID of the buyer\n- Total payment value\n- Currency\n- BTC amounts (expected and received)\n- Transaction ID\n- Payment status\n\nThe `invoice.php` page that was designed to consume this endpoint does require authentication, but `check.php` itself does not inh","public_affected_ranges":["ECOSYSTEM: introduced 0; last_affected 26.0"]}],"null_published_at":"2026-11-02T20:21:10.322Z","source_updated_at":"2026-04-07T14:37:54.283Z","source_disclosed_at":"2026-04-04T06:15:37.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T21:41:49.660Z"},{"id":"NVI-00007332","kind":"vulnerability","title":"AVideo: Unauthenticated Access to Payment Order Data via BlockonomicsYPT check.php","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-3v7m-qg4x-58h9","CVE-2026-35448"],"plain_summary":"OSV carries this publisher advisory for wwbn/avideo. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-2df6a4ec4ffc29c7a5769c2d8e954881"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"0.318%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.24823. Missing scores are unknown.","source_id":"sr-2df6a4ec4ffc29c7a5769c2d8e954881"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-d7af1e4cdeaa664116b85397dbb7c0b4","url":"https://github.com/advisories/GHSA-3v7m-qg4x-58h9","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-3v7m-qg4x-58h9","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:49.660Z"},{"id":"sr-2df6a4ec4ffc29c7a5769c2d8e954881","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-35448","publisher":"FIRST EPSS","observed_at":"2026-10-31T22:06:15.377Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-d7af1e4cdeaa664116b85397dbb7c0b4"],"technology":"wwbn/avideo","known_exclusions":[],"conditions_summary":"## Summary\n\nThe BlockonomicsYPT plugin's `check.php` endpoint returns payment order data for any Bitcoin address without requiring authentication. The endpoint was designed as an AJAX polling helper for the authenticated `invoice.php` page, but it performs no access control checks of its own. Since Bitcoin addresses are publicly visible on the blockchain, an attacker can query payment records for any address used on the platform.\n\n## Details\n\nIn `plugin/BlockonomicsYPT/check.php` at lines 20-30, the endpoint accepts a Bitcoin address and returns the corresponding order data:\n\n```php\n$addr = $_GET['addr'];\n$order = new BlockonomicsOrder(0);\n$obj = $order->getFromAddressFromDb($addr);\ndie(json_encode($obj));\n```\n\nThere is no authentication check. The endpoint does not verify that the requesting user is logged in, nor does it verify that the requesting user owns the order associated with the given address.\n\nThe response includes:\n- User ID of the buyer\n- Total payment value\n- Currency\n- BTC amounts (expected and received)\n- Transaction ID\n- Payment status\n\nThe `invoice.php` page that was designed to consume this endpoint does require authentication, but `check.php` itself does not inh","public_affected_ranges":["ECOSYSTEM: introduced 0; last_affected 26.0"]}],"null_published_at":"2026-10-31T22:27:15.278Z","source_updated_at":"2026-04-07T14:37:54.283Z","source_disclosed_at":"2026-04-04T06:15:37.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:41:49.660Z"},{"id":"NVI-00007332","kind":"vulnerability","title":"AVideo: Unauthenticated Access to Payment Order Data via BlockonomicsYPT check.php","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-3v7m-qg4x-58h9","CVE-2026-35448"],"plain_summary":"OSV carries this publisher advisory for wwbn/avideo. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-d7af1e4cdeaa664116b85397dbb7c0b4"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-d7af1e4cdeaa664116b85397dbb7c0b4","url":"https://github.com/advisories/GHSA-3v7m-qg4x-58h9","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-3v7m-qg4x-58h9","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:49.660Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-d7af1e4cdeaa664116b85397dbb7c0b4"],"technology":"wwbn/avideo","known_exclusions":[],"conditions_summary":"## Summary\n\nThe BlockonomicsYPT plugin's `check.php` endpoint returns payment order data for any Bitcoin address without requiring authentication. The endpoint was designed as an AJAX polling helper for the authenticated `invoice.php` page, but it performs no access control checks of its own. Since Bitcoin addresses are publicly visible on the blockchain, an attacker can query payment records for any address used on the platform.\n\n## Details\n\nIn `plugin/BlockonomicsYPT/check.php` at lines 20-30, the endpoint accepts a Bitcoin address and returns the corresponding order data:\n\n```php\n$addr = $_GET['addr'];\n$order = new BlockonomicsOrder(0);\n$obj = $order->getFromAddressFromDb($addr);\ndie(json_encode($obj));\n```\n\nThere is no authentication check. The endpoint does not verify that the requesting user is logged in, nor does it verify that the requesting user owns the order associated with the given address.\n\nThe response includes:\n- User ID of the buyer\n- Total payment value\n- Currency\n- BTC amounts (expected and received)\n- Transaction ID\n- Payment status\n\nThe `invoice.php` page that was designed to consume this endpoint does require authentication, but `check.php` itself does not inh","public_affected_ranges":["ECOSYSTEM: introduced 0; last_affected 26.0"]}],"null_published_at":"2026-10-31T22:13:14.331Z","source_updated_at":"2026-04-07T14:37:54.283Z","source_disclosed_at":"2026-04-04T06:15:37.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:41:49.660Z"}],"next_cursor":null,"snapshot_revision":"40769"}