Advisories for package WWBN/AVideo

Listing reported advisories for package WWBN/AVideo sorted by their report date.

AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php`
GitHub

WWBN/AVideo

<= 29.0

2026-05-19 16:25:28
AVideo: Authenticated Arbitrary File Read in view/update.php
GitHub

WWBN/AVideo

<= 29.0

2026-05-18 19:01:59
AVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumeration sibling that survives `d9cdc7024`
GitHub

WWBN/AVideo

<= 29.0

2026-05-18 13:30:05
AVideo CVE-2026-43884 incomplete fix - six (or more) `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD post-`603e7bf`
GitHub

WWBN/AVideo

<= 29.0

2026-05-15 18:35:42
AVideo: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA
GitHub

WWBN/AVideo

<= 29.0

2026-05-15 18:35:02
AVideo: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute
GitHub

WWBN/AVideo

<= 29.0

2026-05-15 18:34:01
AVideo: OS command injection in on_publish.php execAsync via unescaped m3u8 URL
GitHub

WWBN/AVideo

<= 29.0

2026-05-15 18:32:37
AVideo's Meet plugin: `uploadRecordedVideo.json.php` derives `users_id` from the uploaded filename and calls passwordless `User->login()`, allowing any caller with the Meet shared secret to obtain a session as arbitrary users including admin
GitHub

WWBN/AVideo

<= 29.0

2026-05-15 18:17:21
AVideo Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization
GitHub

wwbn/avideo

<= 29.0

2026-05-05 22:20:43
AVideo has SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL()
GitHub

wwbn/avideo

<= 29.0

2026-05-05 22:16:34
AVideo: IDOR in PayPalYPT Plugin Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription Agreements
GitHub

wwbn/avideo

<= 29.0

2026-05-05 22:16:13
AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event Spoofing
GitHub

wwbn/avideo

<= 29.0

2026-05-05 22:14:33
AVideo: Unauthenticated User Enumeration in objects/users.json.php via isCompany Parameter Allows Bypass of the Admin-Only Listing Restriction
GitHub

wwbn/avideo

<= 29.0

2026-05-05 22:02:37
AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Enables Phishing from the Site’s Legitimate From Address
GitHub

wwbn/avideo

<= 29.0

2026-05-05 21:56:21
AVideo has Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT_FOLLOWLOCATION Redirect Bypass
GitHub

wwbn/avideo

<= 29.0

2026-05-05 21:49:25
Video: Reflected XSS in plugin/Meet/iframe.php via Unescaped user and pass Parameters in JavaScript String Literal
GitHub

wwbn/avideo

<= 29.0

2026-05-05 19:15:57
AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Authenticated Users' Profile Photos with Arbitrary Content
GitHub

wwbn/avideo

<= 29.0

2026-05-05 19:13:04
AVideo: HTML Injection in notifySubscribers.json.php Allows Platform-Branded Phishing Emails to Channel Subscribers
GitHub

wwbn/avideo

<= 29.0

2026-05-05 19:11:34
AVideo: Password Hash Leak in MobileManager OAuth Redirect URL Enables Account Takeover
GitHub

wwbn/avideo

<= 29.0

2026-05-05 19:08:46
AVideo has an Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']` Relay Bypass
GitHub

wwbn/avideo

<= 29.0

2026-05-05 19:07:10
AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone Server
GitHub

wwbn/avideo

<= 29.0

2026-05-05 18:58:14
WWBN AVideo: RCE cause by clonesite plugin
GitHub

wwbn/avideo

<= 29.0

2026-04-16 21:25:20
WWBN AVideo has an incomplete fix for CVE-2026-33502: Command Injection
GitHub

wwbn/avideo

<= 29.0

2026-04-14 23:27:20
WWBN AVideo has an incomplete fix for CVE-2026-33500: XSS
GitHub

wwbn/avideo

<= 29.0

2026-04-14 23:25:30
WWBN AVideo has an Incomplete fix: Directory traversal bypass via query string in ReceiveImage downloadURL parameters
GitHub

wwbn/avideo

<= 29.0

2026-04-14 23:23:15
WWBN AVideo has Stored XSS via Unanchored Duration Regex in Video Encoder Receiver
GitHub

wwbn/avideo

<= 29.0

2026-04-14 23:22:24
WWBN AVideo has a SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL
GitHub

wwbn/avideo

<= 29.0

2026-04-14 23:22:04
WWBN AVideo has an incomplete fix for CVE-2026-33293: Path Traversal
GitHub

wwbn/avideo

<= 29.0

2026-04-14 23:21:34
WWBN AVideo has a CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) Exposes Authenticated API Responses
GitHub

wwbn/avideo

<= 29.0

2026-04-14 23:18:30
WWBN AVideo has CORS Origin Reflection with Credentials on Sensitive API Endpoints Enables Cross-Origin Account Takeover
GitHub

wwbn/avideo

<= 29.0

2026-04-14 23:18:19
WWBN AVideo has an incomplete fix for CVE-2026-33039: SSRF
GitHub

wwbn/avideo

<= 29.0

2026-04-14 23:15:44
CAPTCHA Bypass in WWBN/AVideo via Attacker-Controlled Length Parameter and Missing Token Invalidation on Failure
GitHub

wwbn/avideo

<= 29.0

2026-04-14 23:13:22
WWBN AVideo is missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creators
GitHub

wwbn/avideo

<= 29.0

2026-04-14 23:13:09
WWBN AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset Deletion
GitHub

wwbn/avideo

<= 29.0

2026-04-14 23:12:54
WWBN AVideo has Multiple CSRF Vulnerabilities in Admin JSON Endpoints (Category CRUD, Plugin Update Script)
GitHub

wwbn/avideo

<= 29.0

2026-04-14 23:12:40
WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials
GitHub

wwbn/avideo

<= 29.0

2026-04-14 23:12:31
WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks
GitHub

wwbn/avideo

<= 29.0

2026-04-14 22:50:07
WWBN AVideo has a Path Traversal in Locale Save Endpoint Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE)
GitHub

wwbn/avideo

<= 29.0

2026-04-14 22:49:48
WWBN AVideo has an Unauthenticated Information Disclosure via git.json.php Exposes Developer Emails and Deployed Version
GitHub

wwbn/avideo

<= 29.0

2026-04-14 22:49:27
WWBN AVideo has an IDOR in Live Restreams list.json.php Exposes Other Users' Stream Keys and OAuth Tokens
GitHub

wwbn/avideo

<= 29.0

2026-04-14 22:49:06
AVideo has a Path Traversal in listFiles.json.php Enables Server Filesystem Enumeration
GitHub

wwbn/avideo

<= 25.0 · <= 14.0

2026-04-13 17:41:30
AVideo has SSRF in Scheduler Plugin via callbackURL Missing `isSSRFSafeURL()` Validation
GitHub

wwbn/avideo

<= 25.0 · <= 14.0

2026-04-13 17:40:21
AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints
GitHub

wwbn/avideo

<= 26.0 · <= 14.3

2026-04-08 23:16:01
AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection
GitHub

wwbn/avideo

<= 26.0

2026-04-08 22:49:57
WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration (Incomplete fix for CVE-2026-27732)
GitHub

WWBN/AVideo

<= 26.0

2026-04-08 00:08:48
WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLs
GitHub

WWBN/AVideo

<= 26.0

2026-04-08 00:08:46
WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services
GitHub

WWBN/AVideo

<= 26.0

2026-04-08 00:08:43
WWBN AVideo has Stored XSS via Malicious EPG XML Program Titles in AVideo EPG Page
GitHub

wwbn/avideo

<= 26.0

2026-04-08 00:08:38
WWBN AVideo Affected by a PayPal IPN Replay Attack Enabling Wallet Balance Inflation via Missing Transaction Deduplication in ipn.php
GitHub

wwbn/avideo

<= 26.0

2026-04-08 00:08:33
AVideo: Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php
GitHub

wwbn/avideo

<= 26.0

2026-04-04 06:17:19
« Previous Next »

Showing 1 to 50 of 149 results

1 2 3