Search for packages
| purl | pkg:composer/wwbn/avideo@11.1.0 |
| Tags | Ghost |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 10.0 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-34hv-f45p-4qfq
Aliases: CVE-2022-27463 |
Open redirect in wwbn/avideo Open redirect vulnerability in objects/login.json.php in WWBN AVideo through 11.6, allows attackers to arbitrarily redirect users … | There are no reported fixed by versions. |
|
GHSA-qvwg-c35p-rqhj
|
Duplicate Advisory: AVideo cross-site scripting vulnerability in the view/about.php page ## Duplicate Advisory This advisory has been withdrawn because it … | There are no reported fixed by versions. |
|
GHSA-f98p-2hc5-fm7v
Aliases: CVE-2024-34899 |
AVideo cross-site scripting vulnerability in the view/about.php page The PHP file view/about.php is vulnerable to an XSS issue due to … | There are no reported fixed by versions. |
|
GHSA-v977-h4hm-rrff
Aliases: CVE-2023-49810 |
WWBN AVideo Improper Restriction of Excessive Authentication Attempts vulnerability A login attempt restriction bypass vulnerability exists in the checkLoginAttempts functionality … | There are no reported fixed by versions. |
|
GHSA-wqcc-qf63-c2x4
Aliases: CVE-2023-49599 |
WWBN AVideo Insufficient Entropy vulnerbaility An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master … | There are no reported fixed by versions. |
|
GHSA-8m5f-2xvp-2c8w
Aliases: CVE-2023-50172 |
WWBN AVideo recovery notification bypass vulnerability A recovery notification bypass vulnerability exists in the userRecoverPass.php captcha validation functionality of WWBN … | There are no reported fixed by versions. |
|
GHSA-wj6r-53f5-q789
|
Duplicate Advisory: AVideo contains Command injection when embedding a video link ## Duplicate Advisory This advisory has been withdrawn because … | There are no reported fixed by versions. |
|
GHSA-2fch-hv74-fgw9
Aliases: GMS-2023-1195 |
Cross site scripting (XSS) in wwbn/avideo Description: While making an account in demo.avideo.com I found a parameter "?success=" which did … | There are no reported fixed by versions. |
|
GHSA-6vrj-ph27-qfp3
Aliases: CVE-2023-30854 GMS-2023-1222 |
Remote code injection in wwbn/avideo # WWBN Avideo Authenticated RCE - OS Command Injection ## Description An OS Command Injection … | There are no reported fixed by versions. |
|
GHSA-pgvh-p3g4-86jw
Aliases: CVE-2023-25313 |
AVideo contains Command injection when embedding a video link Impact: An attacker could execute remote code on a system running … | There are no reported fixed by versions. |
|
GHSA-2mhh-27v7-3vcx
Aliases: CVE-2023-32073 |
WWBN AVideo command injection vulnerability # WWBN AVideo Authenticated RCE A command injection vulnerability exists at `plugin/CloneSite/cloneClient.json.php` which allows Remote … | There are no reported fixed by versions. |
|
GHSA-xr9h-p2rc-rpqm
Aliases: CVE-2023-30860 |
WWBN/AVideo stored XSS vulnerability leads to takeover of any user's account, including admin's account In AVideo, a normal user can … | There are no reported fixed by versions. |
|
GHSA-gmpc-fxg2-vcmq
|
AVideo has Stored XSS via Unescaped Menu Item Fields in TopMenu Plugin ## Summary The TopMenu plugin renders menu item … | There are no reported fixed by versions. |
|
GHSA-6rc6-p838-686f
Aliases: CVE-2026-40909 |
WWBN AVideo has a Path Traversal in Locale Save Endpoint Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE) … | There are no reported fixed by versions. |
|
GHSA-m577-w9j8-ch7j
Aliases: CVE-2026-34738 |
AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter ## Summary AVideo's video processing pipeline accepts an `overrideStatus` request … | There are no reported fixed by versions. |
|
GHSA-m63r-m9jh-3vc6
Aliases: CVE-2026-41062 |
WWBN AVideo has an Incomplete fix: Directory traversal bypass via query string in ReceiveImage downloadURL parameters ## Summary The directory … | There are no reported fixed by versions. |
|
GHSA-793q-xgj6-7frp
Aliases: CVE-2026-41055 |
WWBN AVideo has an incomplete fix for CVE-2026-33039: SSRF ### Summary The incomplete SSRF fix in AVideo's LiveLinks proxy adds … | There are no reported fixed by versions. |
|
GHSA-wwpw-hrx8-79r5
Aliases: CVE-2026-34733 |
AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard ## Summary The AVideo installation script `install/deleteSystemdPrivate.php` contains … | There are no reported fixed by versions. |
|
GHSA-ffw8-fwxp-h64w
Aliases: CVE-2026-40926 |
WWBN AVideo has Multiple CSRF Vulnerabilities in Admin JSON Endpoints (Category CRUD, Plugin Update Script) ## Summary Three admin-only JSON … | There are no reported fixed by versions. |
|
GHSA-cmcr-q4jf-p6q9
Aliases: CVE-2026-39370 |
WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration (Incomplete fix for CVE-2026-27732) … | There are no reported fixed by versions. |
|
GHSA-g2mg-cgr6-vmv7
Aliases: CVE-2026-34732 |
AVideo: Missing Authentication in CreatePlugin list.json.php Template Affects 21 Endpoints ## Summary The AVideo `CreatePlugin` template for `list.json.php` does not … | There are no reported fixed by versions. |
|
GHSA-gph2-j4c9-vhhr
Aliases: CVE-2026-40911 |
WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks ## Summary The YPTSocket … | There are no reported fixed by versions. |
|
GHSA-mmw7-wq3c-wf9p
Aliases: CVE-2026-39366 |
WWBN AVideo Affected by a PayPal IPN Replay Attack Enabling Wallet Balance Inflation via Missing Transaction Deduplication in ipn.php ## … | There are no reported fixed by versions. |
|
GHSA-8qm8-g55h-xmqr
Aliases: CVE-2026-40929 |
WWBN AVideo is missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creators ## Summary `objects/commentDelete.json.php` … | There are no reported fixed by versions. |
|
GHSA-x5vx-vrpf-r45f
Aliases: CVE-2026-34740 |
AVideo: Stored SSRF via Video EPG Link Missing isSSRFSafeURL() Validation ## Summary The EPG (Electronic Program Guide) link feature in … | There are no reported fixed by versions. |
|
GHSA-q4x6-6mm2-crg9
Aliases: CVE-2026-39368 |
WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services ## Summary The Live restream … | There are no reported fixed by versions. |
|
GHSA-x9w5-xccw-5h9w
Aliases: CVE-2026-35179 |
AVideo: Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php ## Summary The SocialMediaPublisher plugin exposes a `publishInstagram.json.php` endpoint that acts as … | There are no reported fixed by versions. |
|
GHSA-rqp3-gf5h-mrqx
Aliases: CVE-2026-39367 |
WWBN AVideo has Stored XSS via Malicious EPG XML Program Titles in AVideo EPG Page ## Summary AVideo's EPG (Electronic … | There are no reported fixed by versions. |
|
GHSA-5879-4fmr-xwf2
Aliases: CVE-2026-41058 |
WWBN AVideo has an incomplete fix for CVE-2026-33293: Path Traversal ### Summary The incomplete fix for AVideo's CloneSite `deleteDump` parameter … | There are no reported fixed by versions. |
|
GHSA-jqrj-chh6-8h78
Aliases: CVE-2026-34739 |
AVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.php ## Summary The User_Location plugin's `testIP.php` page reflects the `ip` … | There are no reported fixed by versions. |
|
GHSA-xr6f-h4x7-r6qp
Aliases: CVE-2026-41304 |
WWBN AVideo: RCE cause by clonesite plugin Description ## Summary The `cloneServer.json.php` endpoint in the CloneSite plugin constructs shell commands … | There are no reported fixed by versions. |
|
GHSA-gpgp-w4x2-h3h7
Aliases: CVE-2026-40907 |
WWBN AVideo has an IDOR in Live Restreams list.json.php Exposes Other Users' Stream Keys and OAuth Tokens ## Summary The … | There are no reported fixed by versions. |
|
GHSA-w4hp-w536-jg64
Aliases: CVE-2026-34716 |
AVideo: DOM XSS via Unsanitized Display Name in WebSocket Call Notification ## Summary The AVideo YPTSocket plugin's caller feature renders … | There are no reported fixed by versions. |
|
GHSA-ff5q-cc22-fgp4
Aliases: CVE-2026-41057 |
WWBN AVideo has a CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) Exposes Authenticated API Responses ## Summary The CORS … | There are no reported fixed by versions. |
|
GHSA-hg8q-8wqr-35xx
Aliases: CVE-2026-35449 |
AVideo: Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.php ## Summary The `install/test.php` diagnostic script has its CLI-only access … | There are no reported fixed by versions. |
|
GHSA-2vg4-rrx4-qcpq
Aliases: CVE-2026-35450 |
AVideo: Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php ## Summary The `plugin/API/check.ffmpeg.json.php` endpoint probes the FFmpeg remote server configuration … | There are no reported fixed by versions. |
|
GHSA-hg7g-56h5-5pqr
Aliases: CVE-2026-40935 |
CAPTCHA Bypass in WWBN/AVideo via Attacker-Controlled Length Parameter and Missing Token Invalidation on Failure ## Summary `objects/getCaptcha.php` accepts the CAPTCHA … | There are no reported fixed by versions. |
|
GHSA-vvfw-4m39-fjqf
Aliases: CVE-2026-40925 |
WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials ## Summary `objects/configurationUpdate.json.php` … | There are no reported fixed by versions. |
|
GHSA-j432-4w3j-3w8j
Aliases: CVE-2026-41060 |
WWBN AVideo has a SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL ## Summary The `isSSRFSafeURL()` function in `objects/functions.php` … | There are no reported fixed by versions. |
|
GHSA-x2pw-9c38-cp2j
Aliases: CVE-2026-40928 |
WWBN AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset Deletion ## … | There are no reported fixed by versions. |
|
GHSA-f4f9-627c-jh33
Aliases: CVE-2026-39369 |
WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLs ## Summary `objects/aVideoEncoderReceiveImage.json.php` allowed … | There are no reported fixed by versions. |
|
GHSA-99j6-hj87-6fcf
Aliases: CVE-2026-35452 |
AVideo: Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php ## Summary The `plugin/CloneSite/client.log.php` endpoint serves the clone operation log … | There are no reported fixed by versions. |
|
GHSA-3v7m-qg4x-58h9
Aliases: CVE-2026-35448 |
AVideo: Unauthenticated Access to Payment Order Data via BlockonomicsYPT check.php ## Summary The BlockonomicsYPT plugin's `check.php` endpoint returns payment order … | There are no reported fixed by versions. |
|
GHSA-c4xj-x7p8-3x7q
Aliases: CVE-2026-34611 |
AVideo: CSRF on emailAllUsers.json.php Enables Mass Phishing Email to All Users ## Summary The AVideo endpoint `objects/emailAllUsers.json.php` allows administrators to … | There are no reported fixed by versions. |
|
GHSA-8pv3-29pp-pf8f
Aliases: CVE-2026-41061 |
WWBN AVideo has Stored XSS via Unanchored Duration Regex in Video Encoder Receiver ## Summary The `isValidDuration()` regex at `objects/video.php:918` … | There are no reported fixed by versions. |
|
GHSA-52hf-63q4-r926
Aliases: CVE-2026-40908 |
WWBN AVideo has an Unauthenticated Information Disclosure via git.json.php Exposes Developer Emails and Deployed Version ## Summary The file `git.json.php` … | There are no reported fixed by versions. |
|
GHSA-pq8p-wc4f-vg7j
Aliases: CVE-2026-41064 |
WWBN AVideo has an incomplete fix for CVE-2026-33502: Command Injection ### Summary The incomplete fix for AVideo's `test.php` adds `escapeshellarg` … | There are no reported fixed by versions. |
|
GHSA-hqxf-mhfw-rc44
Aliases: CVE-2026-34613 |
AVideo: CSRF on Plugin Enable/Disable Endpoint Allows Disabling Security Plugins ## Summary The AVideo endpoint `objects/pluginSwitch.json.php` allows administrators to enable … | There are no reported fixed by versions. |
|
GHSA-38rh-4v39-vfxv
Aliases: CVE-2026-34737 |
AVideo: Arbitrary Stripe Subscription Cancellation via Debug Endpoint and retrieveSubscriptions() Bug ## Summary The StripeYPT plugin includes a `test.php` debug … | There are no reported fixed by versions. |
|
GHSA-ccq9-r5cw-5hwq
Aliases: CVE-2026-41056 |
WWBN AVideo has CORS Origin Reflection with Credentials on Sensitive API Endpoints Enables Cross-Origin Account Takeover ## Summary The `allowOrigin($allowAll=true)` … | There are no reported fixed by versions. |
|
GHSA-4jcg-jxpf-5vq3
Aliases: CVE-2026-34731 |
AVideo: Unauthenticated Live Stream Termination via RTMP Callback on_publish_done.php ## Summary The AVideo `on_publish_done.php` endpoint in the Live plugin allows … | There are no reported fixed by versions. |
|
GHSA-4q27-4rrq-fx95
Aliases: CVE-2026-35181 |
AVideo: CSRF on Player Skin Configuration via admin/playerUpdate.json.php **Severity:** Medium **CWE:** CWE-352 (Cross-Site Request Forgery) ## Summary The player skin … | There are no reported fixed by versions. |
|
GHSA-m7r8-6q9j-m2hc
Aliases: CVE-2026-41063 |
WWBN AVideo has an incomplete fix for CVE-2026-33500: XSS ### Summary The incomplete XSS fix in AVideo's `ParsedownSafeWithLinks` class overrides … | There are no reported fixed by versions. |
|
GHSA-rcqw-6466-3mv7
Aliases: CVE-2026-27568 |
AVideo has Stored Cross-Site Scripting via Markdown Comment Injection ## Vulnerability Type Stored Cross-Site Scripting (XSS) — CWE-79. ## Affected … | There are no reported fixed by versions. |
|
GHSA-hgjh-6wj8-gcgf
Aliases: CVE-2026-50182 |
WWBN AVideo: Unauthenticated Reflected XSS via $_GET['search'] in AVideo YouTubeAPI Gallery Pagination # Unauthenticated Reflected XSS via `$_GET['search']` in AVideo … | There are no reported fixed by versions. |
|
GHSA-c8h8-vq34-9fw2
Aliases: CVE-2026-47694 |
WWBN AVideo: Stored XSS via unescaped Gallery category description ### Summary AVideo stores category descriptions from user input and later … | There are no reported fixed by versions. |
|
GHSA-66q5-cj5g-wrfx
Aliases: CVE-2026-50183 |
WWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery Section # Stored XSS via Hostile YouTube … | There are no reported fixed by versions. |
|
GHSA-9392-pj54-qqf8
Aliases: CVE-2026-47696 |
WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint ### Summary `plugin/AuthorizeNet/processPayment.json.php` credits the logged-in user's wallet based only … | There are no reported fixed by versions. |
|
GHSA-2fhx-q92v-5fhv
Aliases: CVE-2026-49279 |
WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass) # AVideo: Stored XSS via `autoEvalCodeOnHTML` in … | There are no reported fixed by versions. |
|
GHSA-c3ch-22rq-xfwr
Aliases: CVE-2026-45619 |
AVideo CVE-2026-43884 incomplete fix - six (or more) `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD post-`603e7bf` … | There are no reported fixed by versions. |
|
GHSA-958h-qp3x-q4gj
Aliases: CVE-2026-43883 |
AVideo: IDOR in PayPalYPT Plugin Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription Agreements ## Summary `plugin/PayPalYPT/agreementCancel.json.php` cancels a … | There are no reported fixed by versions. |
|
GHSA-5hgj-7gm9-cff5
Aliases: CVE-2026-43880 |
AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Enables Phishing from the Site’s Legitimate From Address ## Summary `objects/sendEmail.json.php` exposes two … | There are no reported fixed by versions. |
|
GHSA-xr49-f4rh-qcjf
Aliases: CVE-2026-43885 |
AVideo Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization ### Summary An unauthenticated user can … | There are no reported fixed by versions. |
|
GHSA-6rvw-7p8v-mjfq
Aliases: CVE-2026-43881 |
AVideo: Unauthenticated User Enumeration in objects/users.json.php via isCompany Parameter Allows Bypass of the Admin-Only Listing Restriction ## Summary `objects/users.json.php` exposes … | There are no reported fixed by versions. |
|
GHSA-g9cm-rxp7-6gv5
Aliases: CVE-2026-43876 |
AVideo: HTML Injection in notifySubscribers.json.php Allows Platform-Branded Phishing Emails to Channel Subscribers ## Summary `objects/notifySubscribers.json.php` takes the raw `message` POST … | There are no reported fixed by versions. |
|
GHSA-3mv2-vmwh-rwfx
Aliases: CVE-2026-45610 |
AVideo: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA ## Summary … | There are no reported fixed by versions. |
|
GHSA-jw8g-5j46-44rp
Aliases: CVE-2026-43877 |
AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Authenticated Users' Profile Photos with Arbitrary Content ## Summary `objects/userSavePhoto.php` is a … | There are no reported fixed by versions. |
|
GHSA-m5j4-7r85-2cj2
Aliases: CVE-2026-45580 |
AVideo: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute ## Summary **Type:** Stored cross-site scripting. The Live plugin's … | There are no reported fixed by versions. |
|
GHSA-qxvm-r42f-5p8j
|
AVideo's Meet plugin: `uploadRecordedVideo.json.php` derives `users_id` from the uploaded filename and calls passwordless `User->login()`, allowing any caller with the Meet … | There are no reported fixed by versions. |
|
GHSA-mwgh-92m2-wvhv
Aliases: CVE-2026-43882 |
AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event Spoofing ## Summary The unauthenticated `plugin/Scheduler/downloadICS.php` endpoint passes attacker-controlled `title`, … | There are no reported fixed by versions. |
|
GHSA-mm5f-8q57-4fc4
Aliases: CVE-2026-43878 |
Video: Reflected XSS in plugin/Meet/iframe.php via Unescaped user and pass Parameters in JavaScript String Literal ## Summary `plugin/Meet/iframe.php` echoes the … | There are no reported fixed by versions. |
|
GHSA-xw67-cg5f-4m2r
Aliases: CVE-2026-45578 |
AVideo: OS command injection in on_publish.php execAsync via unescaped m3u8 URL ## Summary **Type:** Classic shell-metacharacter injection. The YPTSocket notification … | There are no reported fixed by versions. |
|
GHSA-5w8w-26ch-v5cw
Aliases: CVE-2026-43875 |
AVideo: Password Hash Leak in MobileManager OAuth Redirect URL Enables Account Takeover ## Summary `plugin/MobileManager/oauth2.php` completes an OAuth login by … | There are no reported fixed by versions. |
|
GHSA-2hch-c97c-g99x
Aliases: CVE-2026-43884 |
AVideo has SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL() ### Summary Two endpoints in AVideo call … | There are no reported fixed by versions. |
|
GHSA-w4qq-74h6-58wq
Aliases: CVE-2026-46337 |
AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php` ### Summary The endpoint requires **no authentication**. An unauthenticated remote … | There are no reported fixed by versions. |
|
GHSA-wp38-whx3-xffh
Aliases: CVE-2026-43879 |
AVideo has Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT_FOLLOWLOCATION Redirect Bypass ## Summary An authenticated … | There are no reported fixed by versions. |
|
GHSA-vpfx-pxqw-2w79
Aliases: CVE-2026-45620 |
AVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumeration sibling that survives `d9cdc7024` CVE-2026-43881 fix `d9cdc7024` patched `users.json.php` … | There are no reported fixed by versions. |
|
GHSA-ghcv-22jf-vfxm
Aliases: CVE-2026-43874 |
AVideo has an Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']` Relay Bypass ## Summary The … | There are no reported fixed by versions. |
|
GHSA-qm9p-p5pw-jrx2
Aliases: CVE-2026-43873 |
AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone Server … | There are no reported fixed by versions. |
|
GHSA-3mjv-375j-6h92
Aliases: CVE-2026-45731 |
AVideo: Authenticated Arbitrary File Read in view/update.php ### Summary view/update.php reads $_POST['updateFile'] as a relative path under updatedb/ and passes … | There are no reported fixed by versions. |
|
GHSA-q6jj-r49p-94fh
Aliases: CVE-2026-34369 |
AVideo has Video Password Protection Bypass via API Endpoints Returning Full Playback Sources Without Password Verification ## Summary The `get_api_video_file` … | There are no reported fixed by versions. |
|
GHSA-px7x-gq96-rmp5
Aliases: CVE-2026-33041 |
AVideo has an Unauthenticated Password Hash Oracle via encryptPass.json.php ### Summary `/objects/encryptPass.json.php` exposes the application's password hashing algorithm to any … | There are no reported fixed by versions. |
|
GHSA-v4h7-3x43-qqw4
Aliases: CVE-2026-34396 |
AVideo has Stored XSS via Unescaped Plugin Configuration Values in Admin Panel ## Summary The AVideo admin panel renders plugin … | There are no reported fixed by versions. |
|
GHSA-pmj8-r2j7-xg6c
Aliases: CVE-2026-33482 |
AVideo has an OS Command Injection via $() Shell Substitution Bypass in sanitizeFFmpegCommand() ## Summary The `sanitizeFFmpegCommand()` function in `plugin/API/standAlone/functions.php` … | There are no reported fixed by versions. |
|
GHSA-x3pr-vrhq-vq43
Aliases: CVE-2026-33492 |
AVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session Regeneration ## Summary AVideo's `_session_start()` function accepts arbitrary … | There are no reported fixed by versions. |
|
GHSA-hj5h-5623-gwhw
Aliases: CVE-2026-33296 |
AVideo has an Open Redirect via Unvalidated redirectUri in userLogin.php ### Summary WWBN/AVideo contains an open redirect vulnerability in the … | There are no reported fixed by versions. |
|
GHSA-72h5-39r7-r26j
Aliases: CVE-2026-33500 |
AVideo - Incomplete Fix for CVE-2026-27568: Stored XSS via Markdown `javascript:` URI Bypasses ParsedownSafeWithLinks Sanitization ## Summary The fix for … | There are no reported fixed by versions. |
|
GHSA-ghx5-7jjg-q2j7
Aliases: CVE-2026-33683 |
AVideo vulnerable to Stored XSS via html_entity_decode() Reversing xss_esc() Sanitization in Channel About Field ## Summary A sanitization order-of-operations flaw … | There are no reported fixed by versions. |
|
GHSA-77jp-mgcw-rfmr
Aliases: CVE-2026-34395 |
AVideo vulnerable to Mass User PII Disclosure via Missing Authorization in YPTWallet users.json.php **Severity:** High **CWE:** CWE-862 (Missing Authorization) ### … | There are no reported fixed by versions. |
|
GHSA-f359-r3pv-2phf
Aliases: CVE-2026-33766 |
AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints ## Summary `isSSRFSafeURL()` validates URLs against private/reserved IP … | There are no reported fixed by versions. |
|
GHSA-hv36-p4w4-6vmj
Aliases: CVE-2026-33507 |
AVideo Affected by CSRF on Plugin Import Endpoint Enables Unauthenticated Remote Code Execution via Malicious Plugin Upload ## Summary The … | There are no reported fixed by versions. |
|
GHSA-pv87-r9qf-x56p
Aliases: CVE-2026-28501 |
AVideo has Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php ## Impact An unauthenticated SQL Injection vulnerability exists in … | There are no reported fixed by versions. |
|
GHSA-8x77-f38v-4m5j
Aliases: CVE-2026-33650 |
AVideo: Video Moderator Privilege Escalation via Ownership Transfer Enables Arbitrary Video Deletion ## Summary A user with the "Videos Moderator" … | There are no reported fixed by versions. |
|
GHSA-5f7v-4f6g-74rj
Aliases: CVE-2026-33351 |
AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass ### Summary A Server-Side Request Forgery (SSRF) … | There are no reported fixed by versions. |
|
GHSA-75qq-68m8-pvfr
Aliases: CVE-2026-33759 |
AVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist Contents ## Summary The `objects/playlistsVideos.json.php` endpoint returns the full video contents of … | There are no reported fixed by versions. |
|
GHSA-96qp-8cmq-jvq8
Aliases: CVE-2026-33501 |
AVideo has Unauthenticated Information Disclosure of User Group Permission Mappings via Permissions Plugin ## Summary The endpoint `plugin/Permissions/View/Users_groups_permissions/list.json.php` lacks any … | There are no reported fixed by versions. |
|
GHSA-2rm7-j397-3fqg
Aliases: CVE-2026-34245 |
AVideo: Missing Authorization in Playlist Schedule Creation Allows Cross-User Broadcast Hijacking ## Summary The `plugin/PlayLists/View/Playlists_schedules/add.json.php` endpoint allows any authenticated user … | There are no reported fixed by versions. |
|
GHSA-fj74-qxj7-r3vc
Aliases: CVE-2026-33767 |
AVideo has SQL Injection via Partial Prepared Statement — videos_id Concatenated Directly into Query ### Summary In `objects/like.php`, the `getLike()` … | There are no reported fixed by versions. |
|
GHSA-2mg4-pfgx-64cf
Aliases: CVE-2026-34362 |
AVideo's WebSocket Token Never Expires Due to Commented-Out Timeout Validation in verifyTokenSocket() ## Summary The `verifyTokenSocket()` function in `plugin/YPTSocket/functions.php` has … | There are no reported fixed by versions. |
|
GHSA-9x67-f2v7-63rw
Aliases: CVE-2026-33039 |
AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy ## Summary The `plugin/LiveLinks/proxy.php` endpoint validates user-supplied URLs … | There are no reported fixed by versions. |
|
GHSA-xmjm-86qv-g226
Aliases: CVE-2026-33293 |
AVideo Affected by Arbitrary File Deletion via Path Traversal in CloneSite deleteDump Parameter ## Summary The `deleteDump` parameter in `plugin/CloneSite/cloneServer.json.php` … | There are no reported fixed by versions. |
|
GHSA-8wf4-c4x3-h952
Aliases: CVE-2026-33717 |
AVideo: Remote Code Execution via PHP Temp File in Encoder downloadURL ## Summary The `downloadVideoFromDownloadURL()` function in `objects/aVideoEncoder.json.php` saves remote … | There are no reported fixed by versions. |
|
GHSA-g39v-qrj6-jxrh
Aliases: CVE-2026-33764 |
AVideo: IDOR in AI Plugin Allows Stealing Other Users' AI-Generated Metadata and Transcriptions ## Summary The AI plugin's `save.json.php` endpoint … | There are no reported fixed by versions. |
|
GHSA-66cw-h2mj-j39p
Aliases: CVE-2026-33294 |
AVideo Affected by SSRF in BulkEmbed Thumbnail Fetch Allows Reading Internal Network Resources ## Summary The BulkEmbed plugin's save endpoint … | There are no reported fixed by versions. |
|
GHSA-6w2r-cfpc-23r5
Aliases: CVE-2026-30885 |
AVideo has Unauthenticated IDOR - Playlist Information Disclosure **Product:** AVideo (https://github.com/WWBN/AVideo) **Version:** Latest (tested March 2026) **Type:** Insecure Direct Object … | There are no reported fixed by versions. |
|
GHSA-8p58-35c3-ccxx
Aliases: CVE-2026-33485 |
AVideo has an Unauthenticated Blind SQL Injection in RTMP on_publish Callback via Stream Name Parameter ## Summary The RTMP `on_publish` … | There are no reported fixed by versions. |
|
GHSA-5m4q-5cvx-36mw
Aliases: CVE-2026-33648 |
AVideo Vulnerable to OS Command Injection via Unsanitized `users_id` and `liveTransmitionHistory_id` in Restreamer Log File Path ## Summary The restreamer … | There are no reported fixed by versions. |
|
GHSA-363v-5rh8-23wg
Aliases: CVE-2026-33867 |
AVideo has Plaintext Video Password Storage ### Summary AVideo allows content owners to password-protect individual videos. The video password is … | There are no reported fixed by versions. |
|
GHSA-w5ff-2mjc-4phc
Aliases: CVE-2026-33319 |
AVideo has an OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command ## Summary The `uploadVideoToLinkedIn()` method … | There are no reported fixed by versions. |
|
GHSA-vv7w-qf5c-734w
Aliases: CVE-2026-33483 |
AVideo Affected by Unauthenticated Disk Space Exhaustion via Unlimited Temp File Creation in aVideoEncoderChunk.json.php ## Summary The `aVideoEncoderChunk.json.php` endpoint is … | There are no reported fixed by versions. |
|
GHSA-73gr-r64q-7jh4
Aliases: CVE-2026-34364 |
AVideo has User Group-Based Category Access Control Bypass via Missing and Broken Group Filtering in categories.json.php ## Summary The `categories.json.php` … | There are no reported fixed by versions. |
|
GHSA-xggw-g9pm-9qhh
Aliases: CVE-2026-33479 |
AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin ## Summary The Gallery plugin's … | There are no reported fixed by versions. |
|
GHSA-mcj5-6qr4-95fj
Aliases: CVE-2026-33352 |
AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass) ### Summary An unauthenticated SQL injection vulnerability exists … | There are no reported fixed by versions. |
|
GHSA-g8x9-7mgh-7cvj
Aliases: CVE-2026-33649 |
AVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission Modification ## Summary The `plugin/Permissions/setPermission.json.php` endpoint accepts GET parameters … | There are no reported fixed by versions. |
|
GHSA-wfq5-qgqp-hvhv
Aliases: CVE-2026-33035 |
Unauthenticated Reflected XSS via innerHTML in AVideo ## Summary AVideo contains a reflected XSS vulnerability that allows unauthenticated attackers to … | There are no reported fixed by versions. |
|
GHSA-g3hj-mf85-679g
Aliases: CVE-2026-34247 |
AVideo: IDOR in uploadPoster.php Allows Any Authenticated User to Overwrite Scheduled Live Stream Posters and Trigger False Socket Notifications ## … | There are no reported fixed by versions. |
|
GHSA-pw4v-x838-w5pg
Aliases: CVE-2026-33292 |
AVideo has an Authorization Bypass via Path Traversal in HLS Endpoint Allows Streaming Private/Paid Videos ## Summary The HLS streaming … | There are no reported fixed by versions. |
|
GHSA-mwjc-5j4x-r686
Aliases: CVE-2026-33512 |
AVideo has an unauthenticated decrypt oracle leaking any ciphertext ### Summary The API plugin exposes a `decryptString` action without any … | There are no reported fixed by versions. |
|
GHSA-7292-w8qp-mhq2
Aliases: CVE-2026-33499 |
AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php ## Summary The `view/forbiddenPage.php` and `view/warningPage.php` templates reflect the … | There are no reported fixed by versions. |
|
GHSA-8prq-2jr2-cm92
Aliases: CVE-2026-33763 |
AVideo has an Unauthenticated Video Password Brute-Force Vulnerability via Unrate-Limited Boolean Oracle ## Summary The `get_api_video_password_is_correct` API endpoint allows any … | There are no reported fixed by versions. |
|
GHSA-j724-5c6c-68g5
Aliases: CVE-2026-33761 |
AVideo: Unauthenticated Access to Scheduler Plugin Endpoints Leaks Scheduled Tasks, Email Content, and User Mappings ## Summary Three `list.json.php` endpoints … | There are no reported fixed by versions. |
|
GHSA-v467-g7g7-hhfh
Aliases: CVE-2026-33237 |
AVideo has SSRF in Scheduler Plugin via callbackURL Missing `isSSRFSafeURL()` Validation ## Summary The Scheduler plugin's `run()` function in `plugin/Scheduler/Scheduler.php` … | There are no reported fixed by versions. |
|
GHSA-3fpm-8rjr-v5mc
Aliases: CVE-2026-33502 |
AVideo has Unauthenticated SSRF via plugin/Live/test.php ### Summary An unauthenticated server-side request forgery vulnerability in `plugin/Live/test.php` allows any remote user … | There are no reported fixed by versions. |
|
GHSA-4jw9-5hrc-m4j6
Aliases: CVE-2026-33354 |
AVideo has an authenticated arbitrary local file read via `chunkFile` path injection in `aVideoEncoder.json.php` ## Summary `POST /objects/aVideoEncoder.json.php` accepts a … | There are no reported fixed by versions. |
|
GHSA-ffr8-fxhv-fv8h
Aliases: CVE-2026-33723 |
AVideo is Vulnerable to SQL Injection through Subscribe Endpoint via Unsanitized user_id Parameter ## Summary The `Subscribe::save()` method in `objects/subscribe.php` … | There are no reported fixed by versions. |
|
GHSA-687q-32c6-8x68
Aliases: CVE-2026-33478 |
AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection ## Summary Multiple vulnerabilities … | There are no reported fixed by versions. |
|
GHSA-6547-8hrg-c55m
Aliases: CVE-2026-33297 |
AVideo: IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.php ### Summary The `setPassword.json.php` endpoint in the … | There are no reported fixed by versions. |
|
GHSA-pvw4-p2jm-chjm
Aliases: CVE-2026-33651 |
AVideo has a Blind SQL Injection in Live Schedule Reminder via Unsanitized live_schedule_id in Scheduler_commands::getAllActiveOrToRepeat() ## Summary The `remindMe.json.php` endpoint … | There are no reported fixed by versions. |
|
GHSA-8p2x-5cpm-qrqw
Aliases: CVE-2026-33690 |
AVideo vulnerable to IP Address Spoofing via Untrusted HTTP Headers in getRealIpAddr() ## Summary The `getRealIpAddr()` function in `objects/functions.php` trusts … | There are no reported fixed by versions. |
|
GHSA-xxpw-32hf-q8v9
Aliases: CVE-2026-29093 |
AVideo: Unauthenticated PHP session store exposed to host network via published memcached port ## Summary The official `docker-compose.yml` publishes the … | There are no reported fixed by versions. |
|
GHSA-2f9h-23f7-8gcx
Aliases: CVE-2026-33038 |
AVideo affected by unauthenticated application takeover via exposed web installer on uninitialized deployments ## Summary The `install/checkConfiguration.php` endpoint performs full … | There are no reported fixed by versions. |
|
GHSA-h54m-c522-h6qr
Aliases: CVE-2026-34368 |
AVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalance ## Summary The `transferBalance()` method in `plugin/YPTWallet/YPTWallet.php` contains … | There are no reported fixed by versions. |
|
GHSA-3hwv-x8g3-9qpr
Aliases: CVE-2026-33681 |
AVideo has Path Traversal in pluginRunDatabaseScript.json.php Enables Arbitrary SQL File Execution via Unsanitized Plugin Name ## Summary The `objects/pluginRunDatabaseScript.json.php` endpoint … | There are no reported fixed by versions. |
|
GHSA-m99f-mmvg-3xmx
Aliases: CVE-2026-33688 |
AVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery Endpoint ## Summary The password recovery endpoint at … | There are no reported fixed by versions. |
|
GHSA-gc3m-4mcr-h3pv
Aliases: CVE-2026-33295 |
AVideo Affected by Stored XSS via Unescaped Video Title in CDN downloadButtons.php ### Summary WWBN/AVideo contains a stored cross-site scripting … | There are no reported fixed by versions. |
|
GHSA-9hv9-gvwm-95f2
Aliases: CVE-2026-33716 |
AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php ## Summary The standalone live stream control … | There are no reported fixed by versions. |
|
GHSA-8fw8-q79c-fp9m
Aliases: CVE-2026-33513 |
AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP) ### Summary An unauthenticated API … | There are no reported fixed by versions. |
|
GHSA-pm37-62g7-p768
Aliases: CVE-2026-34375 |
AVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment Page ## Summary The YPTWallet Stripe payment … | There are no reported fixed by versions. |
|
GHSA-83xq-8jxj-4rxm
Aliases: CVE-2026-33493 |
AVideo has a Path Traversal in import.json.php Allows Private Video Theft and Arbitrary File Read/Deletion via fileURI Parameter ## Summary … | There are no reported fixed by versions. |
|
GHSA-qc3p-398r-p59j
Aliases: CVE-2026-33043 |
AVideo affected by Session Hijacking via Unauthenticated Session ID Disclosure with Permissive CORS ### Summary `/objects/phpsessionid.json.php` exposes the current PHP … | There are no reported fixed by versions. |
|
GHSA-4wwr-7h7c-chqr
Aliases: CVE-2026-34394 |
AVideo's CSRF on Admin Plugin Configuration Enables Payment Credential Hijacking ## Summary AVideo's admin plugin configuration endpoint (`admin/save.json.php`) lacks any … | There are no reported fixed by versions. |
|
GHSA-6m5f-j7w2-w953
Aliases: CVE-2026-33488 |
AVideo has a PGP 2FA Bypass via Cryptographically Broken 512-bit RSA Key Generation in LoginControl Plugin ## Summary The `createKeys()` … | There are no reported fixed by versions. |
|
GHSA-p3gr-g84w-g8hh
Aliases: CVE-2026-33480 |
AVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks Proxy ## Summary The `isSSRFSafeURL()` function in … | There are no reported fixed by versions. |
|
GHSA-584p-rpvq-35vf
Aliases: CVE-2026-33770 |
AVideo has SQL Injection in category.php fixCleanTitle() via Unparameterized clean_title and id Variables ### Summary The `fixCleanTitle()` static method in … | There are no reported fixed by versions. |
|
GHSA-wxjw-phj6-g75w
Aliases: CVE-2026-33647 |
AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload ## Summary The `ImageGallery::saveFile()` method validates uploaded … | There are no reported fixed by versions. |
|
GHSA-wxjx-r2j2-96fx
|
AVideo: Full-Read SSRF Through Unvalidated statsURL Parameter in plugin/Live/test.php ## Summary The `plugin/Live/test.php` endpoint accepts a URL via the `statsURL` … | There are no reported fixed by versions. |
|
GHSA-j36m-74g2-7m95
Aliases: CVE-2026-33685 |
AVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User Data ## Summary The `plugin/AD_Server/reports.json.php` endpoint … | There are no reported fixed by versions. |
|
GHSA-4wmm-6qxj-fpj4
Aliases: CVE-2026-33238 |
AVideo has a Path Traversal in listFiles.json.php Enables Server Filesystem Enumeration ## Summary The `listFiles.json.php` endpoint accepts a `path` POST … | There are no reported fixed by versions. |
|
GHSA-r64r-883r-wcwh
Aliases: CVE-2026-33719 |
AVideo: Unauthenticated CDN Configuration Takeover via Empty Default Key Bypass and Mass-Assignment ## Summary The CDN plugin endpoints `plugin/CDN/status.json.php` and … | There are no reported fixed by versions. |
|
GHSA-8j8m-p79x-g4jm
Aliases: CVE-2026-33684 |
AVideo's Privilege Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet Permissions ## Summary The `set_api_signUp` method in … | There are no reported fixed by versions. |
|
GHSA-wf69-r4mx-43rr
Aliases: CVE-2026-33692 |
AVideo Vulnerable to Unauthenticated .env File Exposure via Official Docker Compose Configuration ## Vulnerability Details **CWE**: CWE-538 - Insertion of … | There are no reported fixed by versions. |
|
GHSA-95jh-7r58-xmxw
Aliases: CVE-2026-33731 |
AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data ## Summary The Authorize.Net … | There are no reported fixed by versions. |
|
GHSA-7cqp-7cfv-6c3q
|
AVideo Meet plugin: anonymous-to-admin stored XSS via unescaped participant User-Agent in getMeetInfo.json.php Participants panel ### Summary The Meet plugin stores … | There are no reported fixed by versions. |
|
GHSA-wc3f-xc32-435f
Aliases: CVE-2026-55173 |
AVideo has an incomplete fix of CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command execution at … | There are no reported fixed by versions. |
|
CVE-2026-33731
Aliases: GHSA-95jh-7r58-xmxw |
AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data The Authorize.Net webhook handler … | There are no reported fixed by versions. |
|
CVE-2026-28502
Aliases: GHSA-v8jw-8w5p-23g3 |
AVideo has Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction An authenticated Remote Code Execution (RCE) vulnerability was identified … | There are no reported fixed by versions. |
|
GHSA-h39h-7cvg-q7j6
Aliases: CVE-2026-27732 |
AVideo has Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.php ### Vulnerability Type Authenticated Server-Side Request Forgery (SSRF) ### Affected … | There are no reported fixed by versions. |
|
GHSA-rg7q-4223-phjw
|
Duplicate Advisory: AVideo: Unauthenticated Access to Payment Log DataTables Endpoints Exposes Transaction Data, PayPal Tokens, and User Financial Records ### … | There are no reported fixed by versions. |
|
GHSA-wprj-9cvc-5w37
Aliases: CVE-2026-56341 |
AVideo: Unauthenticated Access to Payment Log DataTables Endpoints Exposes Transaction Data, PayPal Tokens, and User Financial Records ## Summary Multiple … | There are no reported fixed by versions. |
|
GHSA-xj9w-cgqg-q897
|
Duplicate Advisory: AVideo has Unauthenticated PGP Message Decryption via Public Endpoint ### Duplicate Advisory This advisory has been withdrawn because … | There are no reported fixed by versions. |
|
GHSA-5x2w-37xf-7962
Aliases: CVE-2026-56346 |
AVideo has Unauthenticated PGP Message Decryption via Public Endpoint ### Summary The AVideo platform exposes a publicly accessible endpoint that … | There are no reported fixed by versions. |
|
GHSA-8whc-2wmv-ww35
Aliases: CVE-2026-54458 |
WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin ## Summary A stored DOM Cross-Site … |
Vulnerable |