SEPTEMBER 13, 2026
Live Feed
Back to database
Case File

CVE-2026-90541

MEDIUM · CVSS 5.3 EPSS 0.24% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-12 · Last synced 2026-09-13

CyberRota Analysis

AI-Generated

The vulnerability allows unauthenticated attackers to access sensitive menu data through the plugin/TopMenu/menus.json.php endpoint in WWBN AVideo, potentially exposing inactive and admin-only menu names. This could lead to information disclosure, aiding further attacks on the system. Organizations using AVideo should prioritize patching this vulnerability to protect their administrative data from unauthorized access.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-90541
Severity
MEDIUM
CVSS
5.3
EPSS
0.24%

Original NVD Description

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to require authentication in the plugin/TopMenu/menus.json.php endpoint, allowing unauthenticated attackers to retrieve all menu data. Attackers can send GET requests to the endpoint to read inactive and admin-only menu names that are not displayed in the public navbar.