This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2026-123486 | BDVDB-2026-401250 Detail

WWBNAVideo

Description#

WWBN AVideo 29.0 through 29.4.0 contains a race condition vulnerability in plugin/PayPalYPT/ipn.php that allows attackers to bypass IPN replay protection due to a non-atomic deduplication check and insert. Attackers can concurrently replay a captured valid recurring-payment notification so both requests pass isRecurringPaymentIdUsed(), obtaining duplicate wallet credits and subscription renewals.

Impact#

Per CVSS v3.1: confidentiality impact none, integrity impact high, availability impact none. Attack vector: network.

Weaknesses#

  • CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

References#

Exploit#

No public exploit known

History#

  1. Version 1Record published in the CVE List.
  2. Version 2Most recent update recorded in the CVE List.