wwbn/avideo

WWBN AVideo plugin/LoginControl/set.json.php: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a…

Affected: through 29.0.

AVideo CVE-2026-43884 incomplete fix - `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD post

Affected: through 29.0.

AVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumeration

Affected: through 29.0.

WWBN AVideo: Authenticated Arbitrary File Read in view/update.php

Affected: through 29.0.

WWBN AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php`

Affected: through 29.0.

WWBN AVideo: Stored XSS via unescaped Gallery category description

Affected: through 29.0.

WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint

Affected: through 29.0.

WWBN AVideo: Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization

Affected: through 29.0.

WWBN AVideo: SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL()

Affected: through 29.0.

WWBN AVideo: IDOR in PayPalYPT agreementCancel.json.php Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription Agreements

Affected: through 29.0.

WWBN AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event Spoofing

Affected: through 29.0.

WWBN AVideo: Unauthenticated User Enumeration in `objects/users.json.php` via `isCompany` Parameter Flips `$ignoreAdmin = true` and…

Affected: through 29.0.

WWBN AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Allows Phishing from Site's Legitimate From Address

Affected: through 29.0.

WWBN AVideo: Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT_FOLLOWLOCATION Redirect Bypass

Affected: through 29.0.

WWBN AVideo: Reflected XSS in plugin/Meet/iframe.php via Unescaped `user`/`pass` Parameters Reflected into JavaScript String Literal

Affected: through 29.0.

WWBN AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Any Logged-in User's Profile Photo with Arbitrary Bytes

Affected: through 29.0.

WWBN AVideo: HTML Injection in notifySubscribers.json.php Enables Platform-Branded Phishing Emails to Channel Subscribers

Affected: through 29.0.

WWBN AVideo: Password Hash Leaked in MobileManager OAuth Redirect URL Enables Account Takeover

Affected: through 29.0.

WWBN AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the…

Affected: through 29.0.

WWBN AVideo: Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']`…

Affected: through 29.0.

WWBN AVideo vulnerable to RCE caused by clonesite plugin

Affected: through 29.0.

AVideo has an incomplete fix for CVE-2026-33502 (Command Injection)

Affected: through 29.0.

WWBN AVideo has incomplete fix for CVE-2026-33500 (XSS)

Affected: through 29.0.

WWBN/AVideo has an incomplete fix for a directory traversal bypass via query string in ReceiveImage downloadURL parameters

Affected: through 29.0.

WWBN AVideo Vulnerable to stored XSS via Unanchored Duration Regex in Video Encoder Receiver

Affected: through 29.0.

AVideo's SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL

Affected: through 29.0.

AVideo has an incomplete fix for CVE-2026-33293 (Path Traversal) in AVideo

Affected: through 29.0.

AVideo has CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) that Exposes Authenticated API Responses

Affected: through 29.0.

AVideos has CORS Origin Reflection with Credentials on Sensitive API Endpoints that Enables Cross-Origin Account Takeover

Affected: through 29.0.

AVideo has an incomplete fix for CVE-2026-33039 (SSRF)

Affected: through 29.0.

WWBN/AVideo has CAPTCHA Bypass via Attacker-Controlled Length Parameter and Missing Token Invalidation on Failure

Affected: through 29.0.

WWBN AVideo's missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content…

Affected: through 29.0.

AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset…

Affected: through 29.0.

WWBN AVideo Vulnerable to CSRF in Admin JSON Endpoints (Category CRUD, Plugin Update Script)

Affected: through 29.0.

WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials

Affected: through 29.0.

WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks

Affected: through 29.0.

WWBN AVideo has a Path Traversal in Locale Save Endpoint that Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE)

Affected: through 29.0.

WWBN AVideo has an Unauthenticated Information Disclosure via git.json.php that Exposes Developer Emails and Deployed Version

Affected: through 29.0.

WWBN AVideo has IDOR in Live Restreams list.json.php that Exposes Other Users' Stream Keys and OAuth Tokens

Affected: through 29.0.

WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration (Incomplete…

Affected: through 26.0.

WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLs

Affected: through 26.0.

WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services

Affected: through 26.0.

WWBN AVideo has Stored XSS via Malicious EPG XML Program Titles in AVideo EPG Page

Affected: through 26.0.

WWBN AVideo Affected by a PayPal IPN Replay Attack Enabling Wallet Balance Inflation via Missing Transaction Deduplication in ipn.php

Affected: through 26.0.

WWBN AVideo has Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php

Affected: through 26.0.

WWBN AVideo has Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php

Affected: through 26.0.

WWBN AVideo has Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.php

Affected: through 26.0.

WWBN AVideo Provides Unauthenticated Access to Payment Order Data via BlockonomicsYPT check.php

Affected: through 26.0.

WWBN AVideo Affected by CSRF on Player Skin Configuration via admin/playerUpdate.json.php

Affected: through 26.0.

WWBN AVideo Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php

Affected: through 26.0.

AVideo: Stored SSRF via Video EPG Link Missing isSSRFSafeURL() Validation

Affected: through 26.0.

AVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.php

Affected: through 26.0.

AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter

Affected: through 26.0.

AVideo: Arbitrary Stripe Subscription Cancellation via Debug Endpoint and retrieveSubscriptions() Bug

Affected: through 26.0.

AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard

Affected: through 26.0.

AVideo: Missing Authentication in CreatePlugin list.json.php Template Affects 21 Endpoints

Affected: through 26.0.

AVideo: Unauthenticated Live Stream Termination via RTMP Callback on_publish_done.php

Affected: through 26.0.

AVideo: DOM XSS via Unsanitized Display Name in WebSocket Call Notification

Affected: through 26.0.

AVideo: CSRF on Plugin Enable/Disable Endpoint Allows Disabling Security Plugins

Affected: through 26.0.

AVideo: CSRF on emailAllUsers.json.php Enables Mass Phishing Email to All Users

Affected: through 26.0.

AVideo: Stored XSS via Unescaped Plugin Configuration Values in Admin Panel

Affected: through 26.0.

AVideo: CSRF on Admin Plugin Configuration Enables Payment Credential Hijacking

Affected: through 26.0.

AVideo: Mass User PII Disclosure via Missing Authorization in YPTWallet users.json.php

Affected: through 26.0.

AVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment Page

Affected: through 26.0.

AVIdeo has Video Password Protection Bypass via API Endpoints Returning Full Playback Sources Without Password Verification

Affected: through 26.0.

AVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalance

Affected: through 26.0.

AVideo has User Group-Based Category Access Control Bypass via Missing and Broken Group Filtering in categories.json.php

Affected: through 26.0.

AVideo's WebSocket Token Never Expires Due to Commented-Out Timeout Validation in verifyTokenSocket()

Affected: through 26.0.

AVideo's IDOR in uploadPoster.php Allows Any Authenticated User to Overwrite Scheduled Live Stream Posters and Trigger False Socket…

Affected: through 26.0.

AVideo's Missing Authorization in Playlist Schedule Creation Allows Cross-User Broadcast Hijacking

Affected: through 26.0.

AVideo has Plaintext Video Password Storage

Affected: through 26.0.

AVideo has SQL Injection in category.php fixCleanTitle() via Unparameterized clean_title and id Variables

Affected: through 26.0.

AVideo has SQL Injection via Partial Prepared Statement — videos_id Concatenated Directly into Query

Affected: fixed in 26.0.

AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints

Affected: through 26.0.

AVideo: IDOR in AI Plugin Allows Stealing Other Users' AI-Generated Metadata and Transcriptions

Affected: through 26.0.

AVideo has an Unauthenticated Video Password Brute-Force Vulnerability via Unrate-Limited Boolean Oracle

Affected: through 26.0.

AVideo: Unauthenticated Access to Scheduler Plugin Endpoints Leaks Scheduled Tasks, Email Content, and User Mappings

Affected: through 26.0.

AVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist Contents

Affected: through 26.0.

AVideo Vulnerable to SQL Injection in Subscribe Endpoint via Unsanitized user_id Parameter in subscribe.php

Affected: through 26.0.

AVideo Vulnerable to Unauthenticated CDN Configuration Takeover via Empty Default Key Bypass and Mass-Assignment in status.json.php

Affected: through 26.0.

AVideo Vulnerable to Remote Code Execution via Persistent PHP Temp File in Encoder downloadURL with Resolution Validation Abort

Affected: through 26.0.

AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php

Affected: through 26.0.

AVideo vulnerable to IP Address Spoofing via Untrusted HTTP Headers in getRealIpAddr()

Affected: through 26.0.

AVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery Endpoint

Affected: through 26.0.

AVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User Data

Affected: through 26.0.

AVideo vulnerable to Stored XSS via html_entity_decode() Reversing xss_esc() Sanitization in Channel About Field

Affected: through 26.0.

AVideo has Path Traversal in pluginRunDatabaseScript.json.php Enables Arbitrary SQL File Execution via Unsanitized Plugin Name

Affected: through 26.0.

AVideo has a Blind SQL Injection in Live Schedule Reminder via Unsanitized live_schedule_id in Scheduler_commands::getAllActiveOrToRepeat()

Affected: through 26.0.

AVideo's Video Moderator Privilege Escalation via Ownership Transfer Enables Arbitrary Video Deletion

Affected: through 26.0.

AVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission Modification

Affected: through 26.0.

AVideo Vulnerable to OS Command Injection via Unsanitized `users_id` and `liveTransmitionHistory_id` in Restreamer Log File Path

Affected: through 26.0.

AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload

Affected: through 26.0.

AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP)

Affected: through 26.0.

AVideo has an unauthenticated decrypt oracle leaking any ciphertext

Affected: through 26.0.

AVideo Affected by CSRF on Plugin Import Endpoint Enables Unauthenticated Remote Code Execution via Malicious Plugin Upload

Affected: through 26.0.

AVideo has Unauthenticated SSRF via plugin/Live/test.php

Affected: through 26.0.

AVideo has Unauthenticated Information Disclosure of User Group Permission Mappings via Permissions Plugin

Affected: through 26.0.

AVideo Vulnerable to Stored XSS via Markdown `javascript:` URI Bypasses ParsedownSafeWithLinks Sanitization

Affected: through 26.0.

AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php

Affected: through 26.0.

AVideo has a Path Traversal in import.json.php that Allows Private Video Theft and Arbitrary File Read/Deletion via fileURI Parameter

Affected: through 26.0.

AVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session Regeneration

Affected: through 26.0.

AVideo has a PGP 2FA Bypass via Cryptographically Broken 512-bit RSA Key Generation in LoginControl Plugin

Affected: through 26.0.

AVideo has an Unauthenticated Blind SQL Injection in RTMP on_publish Callback via Stream Name Parameter

Affected: through 26.0.

AVideo Affected by Unauthenticated Disk Space Exhaustion via Unlimited Temp File Creation in aVideoEncoderChunk.json.php

Affected: through 26.0.

AVideo has an OS Command Injection via $() Shell Substitution Bypass in sanitizeFFmpegCommand()

Affected: through 26.0.

AVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks Proxy

Affected: through 26.0.

AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin

Affected: through 26.0.

AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection

Affected: through 26.0.

AVideo has an authenticated arbitrary local file read via `chunkFile` path injection in `aVideoEncoder.json.php`

Affected: through 26.0.

AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass)

Affected: through 26.0.

AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass

Affected: through 26.0.

AVideo has an IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.php

Affected: through 25.0.

AVideo has an Open Redirect via Unvalidated redirectUri in userLogin.php

Affected: through 25.0.

AVideo Vulnerable to Stored XSS via Unescaped Video Title in CDN downloadButtons.php

Affected: through 25.0.

AVideo has SSRF in BulkEmbed Thumbnail Fetch that Allows Reading Internal Network Resources

Affected: through 25.0.

AVideo Affected by Arbitrary File Deletion via Path Traversal in CloneSite deleteDump Parameter

Affected: through 25.0.

AVideo Vulnerable to OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command

Affected: through 25.0.

AVideo has Authorization Bypass via Path Traversal in HLS Endpoint Allows Streaming Private/Paid Videos

Affected: through 25.0.

AVideo has a Path Traversal in listFiles.json.php that Enables Server Filesystem Enumeration

Affected: fixed in 26.0.

AVideo has SSRF in Scheduler Plugin via callbackURL Missing `isSSRFSafeURL()` Validation

Affected: fixed in 26.0.

AVideo affected by Session Hijacking via Unauthenticated Session ID Disclosure with Permissive CORS

Affected: through 25.0.

AVideo has an Unauthenticated Password Hash Oracle via encryptPass.json.php

Affected: through 25.0.

AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy

Affected: through 25.0.

AVideo affected by unauthenticated application takeover via exposed web installer on uninitialized deployments

Affected: through 25.0.

Unauthenticated Reflected XSS via innerHTML in AVideo

Affected: through 25.0.

WWBN AVideo - Unauthenticated IDOR - Playlist Information Disclosure

Affected: fixed in 25.0.

AVideo: Unauthenticated OS Command Injection via base64Url in objects/getImage.php

Affected: fixed in 7.0.0.

WWBN AVideo: Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php

Affected: through 21.0.0.

WWBN AVideo: Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction

Affected: all versions.

WWBN AVideo: Unauthenticated PHP session store exposed to host network via published memcached port

Affected: through 21.0.

AVideo has Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.php

Affected: fixed in 22.0.

AVideo has Stored Cross-Site Scripting via Markdown Comment Injection

Affected: fixed in 21.0.

WWBN AVideo 12.4 is vulnerable to Cross Site Scripting (XSS).

Affected: fixed in 14.3.

An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath parameter of the…

Affected: from 12.4, fixed in 14.3.

A recovery notification bypass vulnerability exists in the userRecoverPass.php captcha validation functionality of WWBN AVideo dev master…

Affected: through 12.4.

A login attempt restriction bypass vulnerability exists in the checkLoginAttempts functionality of WWBN AVideo dev master commit 15fed957fb.

Affected: through 12.4.

An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed957fb.

Affected: through 12.4.

AVideo command injection vulnerability

Affected: through 12.4.

WWBN/AVideo stored XSS vulnerability leads to takeover of any user's account, including admin's account

Affected: fixed in 12.4.

WWBN AVideo vulnerable to OS Command Injection

Affected: fixed in 12.4.

OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbitrary code via the…

Affected: fixed in 12.4.

Open redirect vulnerability in objects/login.json.php in WWBN AVideo through 11.6, allows attackers to arbitrarily redirect users from a…

Affected: through 11.6.

The import.json.php file before 8.9 for Avideo is vulnerable to a File Deletion vulnerability.

Affected: fixed in 8.9.