Advisories for package WWBN/AVideo

Listing reported advisories for package WWBN/AVideo sorted by their report date.

AVideo: Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php
GitHub

wwbn/avideo

<= 26.0

2026-04-04 06:16:49
AVideo: Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.php
GitHub

wwbn/avideo

<= 26.0

2026-04-04 06:16:19
AVideo: Unauthenticated Access to Payment Order Data via BlockonomicsYPT check.php
GitHub

wwbn/avideo

<= 26.0

2026-04-04 06:15:39
AVideo: CSRF on Player Skin Configuration via admin/playerUpdate.json.php
GitHub

wwbn/avideo

<= 26.0

2026-04-03 23:43:24
AVideo: Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php
GitHub

wwbn/avideo

<= 26.0

2026-04-03 23:33:10
AVideo has Stored XSS via Unescaped Menu Item Fields in TopMenu Plugin
GitHub

wwbn/avideo

<= 26.0

2026-04-01 23:25:12
AVideo: Stored SSRF via Video EPG Link Missing isSSRFSafeURL() Validation
GitHub

wwbn/avideo

<= 26.0

2026-04-01 21:08:41
AVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.php
GitHub

wwbn/avideo

<= 26.0

2026-04-01 21:08:15
AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter
GitHub

wwbn/avideo

<= 26.0

2026-04-01 21:07:27
AVideo: Arbitrary Stripe Subscription Cancellation via Debug Endpoint and retrieveSubscriptions() Bug
GitHub

wwbn/avideo

<= 26.0

2026-04-01 21:06:58
AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard
GitHub

wwbn/avideo

<= 26.0

2026-04-01 21:06:37
AVideo: Missing Authentication in CreatePlugin list.json.php Template Affects 21 Endpoints
GitHub

wwbn/avideo

<= 26.0

2026-04-01 21:06:00
AVideo: Unauthenticated Live Stream Termination via RTMP Callback on_publish_done.php
GitHub

wwbn/avideo

<= 26.0

2026-04-01 21:04:12
AVideo: DOM XSS via Unsanitized Display Name in WebSocket Call Notification
GitHub

wwbn/avideo

<= 26.0

2026-04-01 20:54:52
AVideo: CSRF on Plugin Enable/Disable Endpoint Allows Disabling Security Plugins
GitHub

wwbn/avideo

<= 26.0

2026-04-01 20:54:08
AVideo: CSRF on emailAllUsers.json.php Enables Mass Phishing Email to All Users
GitHub

wwbn/avideo

<= 26.0

2026-04-01 20:48:55
AVideo has Stored XSS via Unescaped Plugin Configuration Values in Admin Panel
GitHub

wwbn/avideo

<= 26.0

2026-03-31 23:22:22
AVideo vulnerable to Mass User PII Disclosure via Missing Authorization in YPTWallet users.json.php
GitHub

wwbn/avideo

<= 26.0

2026-03-31 23:21:51
AVideo's CSRF on Admin Plugin Configuration Enables Payment Credential Hijacking
GitHub

wwbn/avideo

<= 26.0

2026-03-31 23:15:26
AVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment Page
GitHub

wwbn/avideo

<= 26.0

2026-03-30 18:08:53
AVideo has Video Password Protection Bypass via API Endpoints Returning Full Playback Sources Without Password Verification
GitHub

wwbn/avideo

<= 26.0

2026-03-30 18:03:27
AVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalance
GitHub

wwbn/avideo

<= 26.0

2026-03-30 17:51:13
AVideo has User Group-Based Category Access Control Bypass via Missing and Broken Group Filtering in categories.json.php
GitHub

wwbn/avideo

<= 26.0

2026-03-30 17:49:58
AVideo's WebSocket Token Never Expires Due to Commented-Out Timeout Validation in verifyTokenSocket()
GitHub

wwbn/avideo

<= 26.0

2026-03-30 17:35:21
AVideo: IDOR in uploadPoster.php Allows Any Authenticated User to Overwrite Scheduled Live Stream Posters and Trigger False Socket Notifications
GitHub

wwbn/avideo

<= 26.0

2026-03-29 15:41:45
AVideo: Missing Authorization in Playlist Schedule Creation Allows Cross-User Broadcast Hijacking
GitHub

wwbn/avideo

<= 26.0

2026-03-29 15:41:35
AVideo: Unauthenticated Access to Payment Log DataTables Endpoints Exposes Transaction Data, PayPal Tokens, and User Financial Records
GitHub

wwbn/avideo

<= 26.0

2026-03-29 15:40:53
AVideo has Plaintext Video Password Storage
GitHub

wwbn/avideo

<= 26.0

2026-03-26 18:16:41
AVideo has SQL Injection in category.php fixCleanTitle() via Unparameterized clean_title and id Variables
GitHub

wwbn/avideo

<= 26.0

2026-03-26 18:15:11
AVideo has SQL Injection via Partial Prepared Statement — videos_id Concatenated Directly into Query
GitHub

wwbn/avideo

< 26.0

2026-03-26 18:12:36
AVideo: IDOR in AI Plugin Allows Stealing Other Users' AI-Generated Metadata and Transcriptions
GitHub

wwbn/avideo

<= 26.0

2026-03-26 18:08:14
AVideo has an Unauthenticated Video Password Brute-Force Vulnerability via Unrate-Limited Boolean Oracle
GitHub

wwbn/avideo

<= 26.0

2026-03-26 18:07:38
AVideo: Unauthenticated Access to Scheduler Plugin Endpoints Leaks Scheduled Tasks, Email Content, and User Mappings
GitHub

wwbn/avideo

<= 26.0

2026-03-26 18:06:40
AVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist Contents
GitHub

wwbn/avideo

<= 26.0

2026-03-26 18:05:40
AVideo is Vulnerable to SQL Injection through Subscribe Endpoint via Unsanitized user_id Parameter
GitHub

wwbn/avideo

<= 26.0

2026-03-25 21:56:15
AVideo: Unauthenticated CDN Configuration Takeover via Empty Default Key Bypass and Mass-Assignment
GitHub

wwbn/avideo

<= 26.0

2026-03-25 21:55:35
AVideo: Remote Code Execution via PHP Temp File in Encoder downloadURL
GitHub

wwbn/avideo

<= 26.0

2026-03-25 21:28:39
AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php
GitHub

wwbn/avideo

<= 26.0

2026-03-25 21:28:23
AVideo vulnerable to IP Address Spoofing via Untrusted HTTP Headers in getRealIpAddr()
GitHub

wwbn/avideo

<= 26.0

2026-03-25 19:54:44
AVideo: Full-Read SSRF Through Unvalidated statsURL Parameter in plugin/Live/test.php
GitHub

wwbn/avideo

<= 26.0

2026-03-25 19:53:56
AVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery Endpoint
GitHub

wwbn/avideo

<= 26.0

2026-03-25 19:53:01
AVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User Data
GitHub

wwbn/avideo

<= 26.0

2026-03-25 19:52:43
AVideo vulnerable to Stored XSS via html_entity_decode() Reversing xss_esc() Sanitization in Channel About Field
GitHub

wwbn/avideo

<= 26.0

2026-03-25 19:52:23
AVideo has Path Traversal in pluginRunDatabaseScript.json.php Enables Arbitrary SQL File Execution via Unsanitized Plugin Name
GitHub

wwbn/avideo

<= 26.0

2026-03-25 19:51:48
AVideo has a Blind SQL Injection in Live Schedule Reminder via Unsanitized live_schedule_id in Scheduler_commands::getAllActiveOrToRepeat()
GitHub

wwbn/avideo

<= 26.0

2026-03-25 17:50:16
AVideo: Video Moderator Privilege Escalation via Ownership Transfer Enables Arbitrary Video Deletion
GitHub

wwbn/avideo

<= 26.0

2026-03-25 17:49:33
AVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission Modification
GitHub

wwbn/avideo

<= 26.0

2026-03-25 17:48:18
AVideo Vulnerable to OS Command Injection via Unsanitized `users_id` and `liveTransmitionHistory_id` in Restreamer Log File Path
GitHub

wwbn/avideo

<= 26.0

2026-03-25 17:47:22
AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload
GitHub

wwbn/avideo

<= 26.0

2026-03-25 17:45:41
AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP)
GitHub

wwbn/avideo

<= 26.0

2026-03-20 21:55:37
« Previous Next »

Showing 51 to 100 of 149 results

1 2 3