Search for packages
| purl | pkg:composer/wwbn/avideo@29.0.0 |
| Tags | Ghost |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 4.5 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-6rc6-p838-686f
Aliases: CVE-2026-40909 |
WWBN AVideo has a Path Traversal in Locale Save Endpoint Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE) … | There are no reported fixed by versions. |
|
GHSA-m63r-m9jh-3vc6
Aliases: CVE-2026-41062 |
WWBN AVideo has an Incomplete fix: Directory traversal bypass via query string in ReceiveImage downloadURL parameters ## Summary The directory … | There are no reported fixed by versions. |
|
GHSA-793q-xgj6-7frp
Aliases: CVE-2026-41055 |
WWBN AVideo has an incomplete fix for CVE-2026-33039: SSRF ### Summary The incomplete SSRF fix in AVideo's LiveLinks proxy adds … | There are no reported fixed by versions. |
|
GHSA-ffw8-fwxp-h64w
Aliases: CVE-2026-40926 |
WWBN AVideo has Multiple CSRF Vulnerabilities in Admin JSON Endpoints (Category CRUD, Plugin Update Script) ## Summary Three admin-only JSON … | There are no reported fixed by versions. |
|
GHSA-gph2-j4c9-vhhr
Aliases: CVE-2026-40911 |
WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks ## Summary The YPTSocket … | There are no reported fixed by versions. |
|
GHSA-8qm8-g55h-xmqr
Aliases: CVE-2026-40929 |
WWBN AVideo is missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creators ## Summary `objects/commentDelete.json.php` … | There are no reported fixed by versions. |
|
GHSA-5879-4fmr-xwf2
Aliases: CVE-2026-41058 |
WWBN AVideo has an incomplete fix for CVE-2026-33293: Path Traversal ### Summary The incomplete fix for AVideo's CloneSite `deleteDump` parameter … | There are no reported fixed by versions. |
|
GHSA-xr6f-h4x7-r6qp
Aliases: CVE-2026-41304 |
WWBN AVideo: RCE cause by clonesite plugin Description ## Summary The `cloneServer.json.php` endpoint in the CloneSite plugin constructs shell commands … | There are no reported fixed by versions. |
|
GHSA-gpgp-w4x2-h3h7
Aliases: CVE-2026-40907 |
WWBN AVideo has an IDOR in Live Restreams list.json.php Exposes Other Users' Stream Keys and OAuth Tokens ## Summary The … | There are no reported fixed by versions. |
|
GHSA-ff5q-cc22-fgp4
Aliases: CVE-2026-41057 |
WWBN AVideo has a CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) Exposes Authenticated API Responses ## Summary The CORS … | There are no reported fixed by versions. |
|
GHSA-hg7g-56h5-5pqr
Aliases: CVE-2026-40935 |
CAPTCHA Bypass in WWBN/AVideo via Attacker-Controlled Length Parameter and Missing Token Invalidation on Failure ## Summary `objects/getCaptcha.php` accepts the CAPTCHA … | There are no reported fixed by versions. |
|
GHSA-vvfw-4m39-fjqf
Aliases: CVE-2026-40925 |
WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials ## Summary `objects/configurationUpdate.json.php` … | There are no reported fixed by versions. |
|
GHSA-j432-4w3j-3w8j
Aliases: CVE-2026-41060 |
WWBN AVideo has a SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL ## Summary The `isSSRFSafeURL()` function in `objects/functions.php` … | There are no reported fixed by versions. |
|
GHSA-x2pw-9c38-cp2j
Aliases: CVE-2026-40928 |
WWBN AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset Deletion ## … | There are no reported fixed by versions. |
|
GHSA-8pv3-29pp-pf8f
Aliases: CVE-2026-41061 |
WWBN AVideo has Stored XSS via Unanchored Duration Regex in Video Encoder Receiver ## Summary The `isValidDuration()` regex at `objects/video.php:918` … | There are no reported fixed by versions. |
|
GHSA-52hf-63q4-r926
Aliases: CVE-2026-40908 |
WWBN AVideo has an Unauthenticated Information Disclosure via git.json.php Exposes Developer Emails and Deployed Version ## Summary The file `git.json.php` … | There are no reported fixed by versions. |
|
GHSA-pq8p-wc4f-vg7j
Aliases: CVE-2026-41064 |
WWBN AVideo has an incomplete fix for CVE-2026-33502: Command Injection ### Summary The incomplete fix for AVideo's `test.php` adds `escapeshellarg` … | There are no reported fixed by versions. |
|
GHSA-ccq9-r5cw-5hwq
Aliases: CVE-2026-41056 |
WWBN AVideo has CORS Origin Reflection with Credentials on Sensitive API Endpoints Enables Cross-Origin Account Takeover ## Summary The `allowOrigin($allowAll=true)` … | There are no reported fixed by versions. |
|
GHSA-m7r8-6q9j-m2hc
Aliases: CVE-2026-41063 |
WWBN AVideo has an incomplete fix for CVE-2026-33500: XSS ### Summary The incomplete XSS fix in AVideo's `ParsedownSafeWithLinks` class overrides … | There are no reported fixed by versions. |
|
GHSA-hgjh-6wj8-gcgf
Aliases: CVE-2026-50182 |
WWBN AVideo: Unauthenticated Reflected XSS via $_GET['search'] in AVideo YouTubeAPI Gallery Pagination # Unauthenticated Reflected XSS via `$_GET['search']` in AVideo … | There are no reported fixed by versions. |
|
GHSA-c8h8-vq34-9fw2
Aliases: CVE-2026-47694 |
WWBN AVideo: Stored XSS via unescaped Gallery category description ### Summary AVideo stores category descriptions from user input and later … | There are no reported fixed by versions. |
|
GHSA-66q5-cj5g-wrfx
Aliases: CVE-2026-50183 |
WWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery Section # Stored XSS via Hostile YouTube … | There are no reported fixed by versions. |
|
GHSA-9392-pj54-qqf8
Aliases: CVE-2026-47696 |
WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint ### Summary `plugin/AuthorizeNet/processPayment.json.php` credits the logged-in user's wallet based only … | There are no reported fixed by versions. |
|
GHSA-2fhx-q92v-5fhv
Aliases: CVE-2026-49279 |
WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass) # AVideo: Stored XSS via `autoEvalCodeOnHTML` in … | There are no reported fixed by versions. |
|
GHSA-c3ch-22rq-xfwr
Aliases: CVE-2026-45619 |
AVideo CVE-2026-43884 incomplete fix - six (or more) `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD post-`603e7bf` … | There are no reported fixed by versions. |
|
GHSA-958h-qp3x-q4gj
Aliases: CVE-2026-43883 |
AVideo: IDOR in PayPalYPT Plugin Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription Agreements ## Summary `plugin/PayPalYPT/agreementCancel.json.php` cancels a … | There are no reported fixed by versions. |
|
GHSA-5hgj-7gm9-cff5
Aliases: CVE-2026-43880 |
AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Enables Phishing from the Site’s Legitimate From Address ## Summary `objects/sendEmail.json.php` exposes two … | There are no reported fixed by versions. |
|
GHSA-xr49-f4rh-qcjf
Aliases: CVE-2026-43885 |
AVideo Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization ### Summary An unauthenticated user can … | There are no reported fixed by versions. |
|
GHSA-6rvw-7p8v-mjfq
Aliases: CVE-2026-43881 |
AVideo: Unauthenticated User Enumeration in objects/users.json.php via isCompany Parameter Allows Bypass of the Admin-Only Listing Restriction ## Summary `objects/users.json.php` exposes … | There are no reported fixed by versions. |
|
GHSA-g9cm-rxp7-6gv5
Aliases: CVE-2026-43876 |
AVideo: HTML Injection in notifySubscribers.json.php Allows Platform-Branded Phishing Emails to Channel Subscribers ## Summary `objects/notifySubscribers.json.php` takes the raw `message` POST … | There are no reported fixed by versions. |
|
GHSA-3mv2-vmwh-rwfx
Aliases: CVE-2026-45610 |
AVideo: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA ## Summary … | There are no reported fixed by versions. |
|
GHSA-jw8g-5j46-44rp
Aliases: CVE-2026-43877 |
AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Authenticated Users' Profile Photos with Arbitrary Content ## Summary `objects/userSavePhoto.php` is a … | There are no reported fixed by versions. |
|
GHSA-m5j4-7r85-2cj2
Aliases: CVE-2026-45580 |
AVideo: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute ## Summary **Type:** Stored cross-site scripting. The Live plugin's … | There are no reported fixed by versions. |
|
GHSA-qxvm-r42f-5p8j
|
AVideo's Meet plugin: `uploadRecordedVideo.json.php` derives `users_id` from the uploaded filename and calls passwordless `User->login()`, allowing any caller with the Meet … | There are no reported fixed by versions. |
|
GHSA-mwgh-92m2-wvhv
Aliases: CVE-2026-43882 |
AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event Spoofing ## Summary The unauthenticated `plugin/Scheduler/downloadICS.php` endpoint passes attacker-controlled `title`, … | There are no reported fixed by versions. |
|
GHSA-mm5f-8q57-4fc4
Aliases: CVE-2026-43878 |
Video: Reflected XSS in plugin/Meet/iframe.php via Unescaped user and pass Parameters in JavaScript String Literal ## Summary `plugin/Meet/iframe.php` echoes the … | There are no reported fixed by versions. |
|
GHSA-xw67-cg5f-4m2r
Aliases: CVE-2026-45578 |
AVideo: OS command injection in on_publish.php execAsync via unescaped m3u8 URL ## Summary **Type:** Classic shell-metacharacter injection. The YPTSocket notification … | There are no reported fixed by versions. |
|
GHSA-5w8w-26ch-v5cw
Aliases: CVE-2026-43875 |
AVideo: Password Hash Leak in MobileManager OAuth Redirect URL Enables Account Takeover ## Summary `plugin/MobileManager/oauth2.php` completes an OAuth login by … | There are no reported fixed by versions. |
|
GHSA-2hch-c97c-g99x
Aliases: CVE-2026-43884 |
AVideo has SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL() ### Summary Two endpoints in AVideo call … | There are no reported fixed by versions. |
|
GHSA-w4qq-74h6-58wq
Aliases: CVE-2026-46337 |
AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php` ### Summary The endpoint requires **no authentication**. An unauthenticated remote … | There are no reported fixed by versions. |
|
GHSA-wp38-whx3-xffh
Aliases: CVE-2026-43879 |
AVideo has Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT_FOLLOWLOCATION Redirect Bypass ## Summary An authenticated … | There are no reported fixed by versions. |
|
GHSA-vpfx-pxqw-2w79
Aliases: CVE-2026-45620 |
AVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumeration sibling that survives `d9cdc7024` CVE-2026-43881 fix `d9cdc7024` patched `users.json.php` … | There are no reported fixed by versions. |
|
GHSA-ghcv-22jf-vfxm
Aliases: CVE-2026-43874 |
AVideo has an Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']` Relay Bypass ## Summary The … | There are no reported fixed by versions. |
|
GHSA-qm9p-p5pw-jrx2
Aliases: CVE-2026-43873 |
AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone Server … | There are no reported fixed by versions. |
|
GHSA-3mjv-375j-6h92
Aliases: CVE-2026-45731 |
AVideo: Authenticated Arbitrary File Read in view/update.php ### Summary view/update.php reads $_POST['updateFile'] as a relative path under updatedb/ and passes … | There are no reported fixed by versions. |
|
GHSA-7cqp-7cfv-6c3q
|
AVideo Meet plugin: anonymous-to-admin stored XSS via unescaped participant User-Agent in getMeetInfo.json.php Participants panel ### Summary The Meet plugin stores … | There are no reported fixed by versions. |
|
GHSA-wc3f-xc32-435f
Aliases: CVE-2026-55173 |
AVideo has an incomplete fix of CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command execution at … | There are no reported fixed by versions. |
|
CVE-2026-28502
Aliases: GHSA-v8jw-8w5p-23g3 |
AVideo has Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction An authenticated Remote Code Execution (RCE) vulnerability was identified … | There are no reported fixed by versions. |
|
GHSA-8whc-2wmv-ww35
Aliases: CVE-2026-54458 |
WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin ## Summary A stored DOM Cross-Site … |
Vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
GHSA-8j8m-p79x-g4jm
|
AVideo's Privilege Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet Permissions ## Summary The `set_api_signUp` method in … |
CVE-2026-33684
|
|
GHSA-wf69-r4mx-43rr
|
AVideo Vulnerable to Unauthenticated .env File Exposure via Official Docker Compose Configuration ## Vulnerability Details **CWE**: CWE-538 - Insertion of … |
CVE-2026-33692
|
|
GHSA-95jh-7r58-xmxw
|
AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data ## Summary The Authorize.Net … |
CVE-2026-33731
|
|
CVE-2026-33731
|
AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data The Authorize.Net webhook handler … |
GHSA-95jh-7r58-xmxw
|