Advisories for package wwbn/avideo

Listing reported advisories for package wwbn/avideo sorted by their report date.

AVideo has Plaintext Video Password Storage
GitHub

wwbn/avideo

<= 26.0

2026-03-26 18:16:41
AVideo has SQL Injection in category.php fixCleanTitle() via Unparameterized clean_title and id Variables
GitHub

wwbn/avideo

<= 26.0

2026-03-26 18:15:11
AVideo has SQL Injection via Partial Prepared Statement — videos_id Concatenated Directly into Query
GitHub

wwbn/avideo

< 26.0

2026-03-26 18:12:36
AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints
GitHub

wwbn/avideo

<= 14.3

2026-03-26 18:10:50
AVideo: IDOR in AI Plugin Allows Stealing Other Users' AI-Generated Metadata and Transcriptions
GitHub

wwbn/avideo

<= 26.0

2026-03-26 18:08:14
AVideo has an Unauthenticated Video Password Brute-Force Vulnerability via Unrate-Limited Boolean Oracle
GitHub

wwbn/avideo

<= 26.0

2026-03-26 18:07:38
AVideo: Unauthenticated Access to Scheduler Plugin Endpoints Leaks Scheduled Tasks, Email Content, and User Mappings
GitHub

wwbn/avideo

<= 26.0

2026-03-26 18:06:40
AVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist Contents
GitHub

wwbn/avideo

<= 26.0

2026-03-26 18:05:40
AVideo is Vulnerable to SQL Injection through Subscribe Endpoint via Unsanitized user_id Parameter
GitHub

wwbn/avideo

<= 26.0

2026-03-25 21:56:15
AVideo: Unauthenticated CDN Configuration Takeover via Empty Default Key Bypass and Mass-Assignment
GitHub

wwbn/avideo

<= 26.0

2026-03-25 21:55:35
AVideo: Remote Code Execution via PHP Temp File in Encoder downloadURL
GitHub

wwbn/avideo

<= 26.0

2026-03-25 21:28:39
AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php
GitHub

wwbn/avideo

<= 26.0

2026-03-25 21:28:23
AVideo vulnerable to IP Address Spoofing via Untrusted HTTP Headers in getRealIpAddr()
GitHub

wwbn/avideo

<= 26.0

2026-03-25 19:54:44
AVideo: Full-Read SSRF Through Unvalidated statsURL Parameter in plugin/Live/test.php
GitHub

wwbn/avideo

<= 26.0

2026-03-25 19:53:56
AVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery Endpoint
GitHub

wwbn/avideo

<= 26.0

2026-03-25 19:53:01
AVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User Data
GitHub

wwbn/avideo

<= 26.0

2026-03-25 19:52:43
AVideo vulnerable to Stored XSS via html_entity_decode() Reversing xss_esc() Sanitization in Channel About Field
GitHub

wwbn/avideo

<= 26.0

2026-03-25 19:52:23
AVideo has Path Traversal in pluginRunDatabaseScript.json.php Enables Arbitrary SQL File Execution via Unsanitized Plugin Name
GitHub

wwbn/avideo

<= 26.0

2026-03-25 19:51:48
AVideo has a Blind SQL Injection in Live Schedule Reminder via Unsanitized live_schedule_id in Scheduler_commands::getAllActiveOrToRepeat()
GitHub

wwbn/avideo

<= 26.0

2026-03-25 17:50:16
AVideo: Video Moderator Privilege Escalation via Ownership Transfer Enables Arbitrary Video Deletion
GitHub

wwbn/avideo

<= 26.0

2026-03-25 17:49:33
AVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission Modification
GitHub

wwbn/avideo

<= 26.0

2026-03-25 17:48:18
AVideo Vulnerable to OS Command Injection via Unsanitized `users_id` and `liveTransmitionHistory_id` in Restreamer Log File Path
GitHub

wwbn/avideo

<= 26.0

2026-03-25 17:47:22
AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload
GitHub

wwbn/avideo

<= 26.0

2026-03-25 17:45:41
AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP)
GitHub

wwbn/avideo

<= 26.0

2026-03-20 21:55:37
AVideo has an unauthenticated decrypt oracle leaking any ciphertext
GitHub

wwbn/avideo

<= 26.0

2026-03-20 21:55:17
AVideo Affected by CSRF on Plugin Import Endpoint Enables Unauthenticated Remote Code Execution via Malicious Plugin Upload
GitHub

wwbn/avideo

<= 26.0

2026-03-20 21:47:51
AVideo has Unauthenticated SSRF via plugin/Live/test.php
GitHub

wwbn/avideo

<= 26.0

2026-03-20 20:57:57
AVideo has Unauthenticated Information Disclosure of User Group Permission Mappings via Permissions Plugin
GitHub

wwbn/avideo

<= 26.0

2026-03-20 20:57:44
AVideo - Incomplete Fix for CVE-2026-27568: Stored XSS via Markdown `javascript:` URI Bypasses ParsedownSafeWithLinks Sanitization
GitHub

wwbn/avideo

<= 26.0

2026-03-20 20:56:52
AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php
GitHub

wwbn/avideo

<= 26.0

2026-03-20 20:56:38
AVideo has a Path Traversal in import.json.php Allows Private Video Theft and Arbitrary File Read/Deletion via fileURI Parameter
GitHub

wwbn/avideo

<= 26.0

2026-03-20 20:49:37
AVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session Regeneration
GitHub

wwbn/avideo

<= 26.0

2026-03-20 20:49:25
AVideo has a PGP 2FA Bypass via Cryptographically Broken 512-bit RSA Key Generation in LoginControl Plugin
GitHub

wwbn/avideo

<= 26.0

2026-03-20 20:49:07
AVideo has an Unauthenticated Blind SQL Injection in RTMP on_publish Callback via Stream Name Parameter
GitHub

wwbn/avideo

<= 26.0

2026-03-20 20:47:20
AVideo Affected by Unauthenticated Disk Space Exhaustion via Unlimited Temp File Creation in aVideoEncoderChunk.json.php
GitHub

wwbn/avideo

<= 26.0

2026-03-20 20:46:52
AVideo has an OS Command Injection via $() Shell Substitution Bypass in sanitizeFFmpegCommand()
GitHub

wwbn/avideo

<= 26.0

2026-03-20 20:46:42
AVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks Proxy
GitHub

wwbn/avideo

<= 26.0

2026-03-20 20:44:12
AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin
GitHub

wwbn/avideo

<= 26.0

2026-03-20 20:44:04
AVideo has an authenticated arbitrary local file read via `chunkFile` path injection in `aVideoEncoder.json.php`
GitHub

wwbn/avideo

<= 26.0

2026-03-19 19:34:07
AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass)
GitHub

wwbn/avideo

<= 26.0

2026-03-19 19:25:54
AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass
GitHub

wwbn/avideo

<= 26.0

2026-03-19 19:13:30
AVideo: IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.php
GitHub

wwbn/avideo

<= 25.0

2026-03-19 17:25:37
AVideo has an Open Redirect via Unvalidated redirectUri in userLogin.php
GitHub

wwbn/avideo

<= 25.0

2026-03-19 17:25:32
AVideo Affected by Stored XSS via Unescaped Video Title in CDN downloadButtons.php
GitHub

wwbn/avideo

<= 25.0

2026-03-19 17:12:20
AVideo Affected by SSRF in BulkEmbed Thumbnail Fetch Allows Reading Internal Network Resources
GitHub

wwbn/avideo

<= 25.0

2026-03-19 17:12:15
AVideo Affected by Arbitrary File Deletion via Path Traversal in CloneSite deleteDump Parameter
GitHub

wwbn/avideo

<= 25.0

2026-03-19 17:12:05
AVideo has an Authorization Bypass via Path Traversal in HLS Endpoint Allows Streaming Private/Paid Videos
GitHub

wwbn/avideo

<= 25.0

2026-03-19 16:43:07
AVideo has Unauthenticated PGP Message Decryption via Public Endpoint
GitHub

wwbn/avideo

<= 25.0

2026-03-19 12:46:02
AVideo has an OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command
GitHub

wwbn/avideo

<= 25.0

2026-03-19 12:45:38
AVideo has a Path Traversal in listFiles.json.php Enables Server Filesystem Enumeration
GitHub

wwbn/avideo

<= 14.0

2026-03-19 12:43:43
« Previous Next »

Showing 1 to 50 of 75 results

1 2