# wwbn/avideo (Packagist) vulnerabilities

158 known vulnerabilities (16 critical, 59 high, 79 medium, 2 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://packagist.org/packages/wwbn/avideo

## Advisories (158)

### [CVE-2026-33731](https://cve.now/CVE-2026-33731): AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data

- Severity: Medium 6.5
- Published: Jul 16, 2026
- Affected: fixed in 29.0.

### [CVE-2026-55173](https://cve.now/CVE-2026-55173): AVideo incomplete fix for CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command…

- Severity: High 8.1
- Published: Jul 16, 2026
- Affected: through 29.0.

### [CVE-2026-33692](https://cve.now/CVE-2026-33692): AVideo Has Unauthenticated .env File Exposure via Official Docker Compose Configuration

- Severity: High 7.5
- Published: Jul 16, 2026
- Affected: fixed in 29.0.

### [CVE-2026-54458](https://cve.now/CVE-2026-54458): AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin

- Severity: Critical 9.6
- Published: Jul 15, 2026
- Affected: fixed in 29.1.0.

### [CVE-2026-50183](https://cve.now/CVE-2026-50183): WWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery Section

- Severity: Medium 4.7
- Published: Jul 15, 2026
- Affected: through 29.0.

### [CVE-2026-50182](https://cve.now/CVE-2026-50182): AVideo Has Unauthenticated Reflected XSS via $\_GET\['search'\] in YouTubeAPI Gallery Pagination

- Severity: Medium 6.1
- Published: Jul 15, 2026
- Affected: through 29.0.

### [CVE-2026-49279](https://cve.now/CVE-2026-49279): WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass)

- Severity: High 7.7
- Published: Jul 15, 2026
- Affected: through 29.0.

### [CVE-2026-33684](https://cve.now/CVE-2026-33684): AVideo's Privilege AVideo: Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet Permissions

- Severity: Medium 5.3
- Published: Jul 15, 2026
- Affected: fixed in 29.0.

### [CVE-2026-60092](https://cve.now/CVE-2026-60092): AVideo - Stored Cross-Site Scripting via Unescaped User-Agent in Participants Panel

- Severity: Medium 5.1
- Published: Jul 8, 2026
- Affected: through 29.0.

### [CVE-2026-56347](https://cve.now/CVE-2026-56347): AVideo TopMenu Plugin - Stored Cross-Site Scripting via Unescaped Menu Item Fields

- Severity: Medium 5.3
- Published: Jun 20, 2026
- Affected: through 26.0.

### [CVE-2026-56346](https://cve.now/CVE-2026-56346): AVideo - Unauthenticated PGP Message Decryption via decryptMessage.json.php Endpoint

- Severity: Medium 6.9
- Published: Jun 20, 2026
- Affected: through 25.0.

### [CVE-2026-56345](https://cve.now/CVE-2026-56345): AVideo - Arbitrary User Session Hijacking via Meet Plugin uploadRecordedVideo Endpoint

- Severity: Critical 9.2
- Published: Jun 20, 2026
- Affected: through 29.0.

### [CVE-2026-56341](https://cve.now/CVE-2026-56341): AVideo - Unauthenticated Access to Payment Log DataTables Endpoints via list.json.php

- Severity: High 8.7
- Published: Jun 20, 2026
- Affected: through 26.0.

### [CVE-2026-45580](https://cve.now/CVE-2026-45580): WWBN AVideo Live: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute

- Severity: Medium 5.4
- Published: May 29, 2026
- Affected: through 29.0.

### [CVE-2026-45578](https://cve.now/CVE-2026-45578): WWBN AVideo Live: OS command injection in on\_publish.php execAsync via unescaped m3u8 URL

- Severity: High 8.8
- Published: May 29, 2026
- Affected: through 29.0.

### [CVE-2026-45610](https://cve.now/CVE-2026-45610): WWBN AVideo plugin/LoginControl/set.json.php: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a…

- Severity: Medium 5.7
- Published: May 29, 2026
- Affected: through 29.0.

### [CVE-2026-45619](https://cve.now/CVE-2026-45619): AVideo CVE-2026-43884 incomplete fix - \`isSSRFSafeURL()\` call sites still discard the \`$resolvedIP\` out-param at master HEAD post

- Severity: Medium 6.5
- Published: May 29, 2026
- Affected: through 29.0.

### [CVE-2026-45620](https://cve.now/CVE-2026-45620): AVideo CVE-2026-43881 incomplete fix - \`objects/mention.json.php:17\` is an unauthenticated user enumeration

- Severity: Medium 5.3
- Published: May 29, 2026
- Affected: through 29.0.

### [CVE-2026-45731](https://cve.now/CVE-2026-45731): WWBN AVideo: Authenticated Arbitrary File Read in view/update.php

- Severity: Medium 6.9
- Published: May 29, 2026
- Affected: through 29.0.

### [CVE-2026-46337](https://cve.now/CVE-2026-46337): WWBN AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in \`view/img/image404Raw.php\`

- Severity: Medium 6.9
- Published: May 29, 2026
- Affected: through 29.0.

### [CVE-2026-47694](https://cve.now/CVE-2026-47694): WWBN AVideo: Stored XSS via unescaped Gallery category description

- Severity: Medium 5.4
- Published: May 29, 2026
- Affected: through 29.0.

### [CVE-2026-47696](https://cve.now/CVE-2026-47696): WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint

- Severity: High 7.1
- Published: May 29, 2026
- Affected: through 29.0.

### [CVE-2026-43885](https://cve.now/CVE-2026-43885): WWBN AVideo: Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization

- Severity: High 7.7
- Published: May 11, 2026
- Affected: through 29.0.

### [CVE-2026-43884](https://cve.now/CVE-2026-43884): WWBN AVideo: SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL()

- Severity: High 7.7
- Published: May 11, 2026
- Affected: through 29.0.

### [CVE-2026-43883](https://cve.now/CVE-2026-43883): WWBN AVideo: IDOR in PayPalYPT agreementCancel.json.php Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription Agreements

- Severity: Medium 4.2
- Published: May 11, 2026
- Affected: through 29.0.

### [CVE-2026-43882](https://cve.now/CVE-2026-43882): WWBN AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event Spoofing

- Severity: Medium 4.3
- Published: May 11, 2026
- Affected: through 29.0.

### [CVE-2026-43881](https://cve.now/CVE-2026-43881): WWBN AVideo: Unauthenticated User Enumeration in \`objects/users.json.php\` via \`isCompany\` Parameter Flips \`$ignoreAdmin = true\` and…

- Severity: Medium 5.3
- Published: May 11, 2026
- Affected: through 29.0.

### [CVE-2026-43880](https://cve.now/CVE-2026-43880): WWBN AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Allows Phishing from Site's Legitimate From Address

- Severity: Medium 5.3
- Published: May 11, 2026
- Affected: through 29.0.

### [CVE-2026-43879](https://cve.now/CVE-2026-43879): WWBN AVideo: Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT\_FOLLOWLOCATION Redirect Bypass

- Severity: Medium 5.4
- Published: May 11, 2026
- Affected: through 29.0.

### [CVE-2026-43878](https://cve.now/CVE-2026-43878): WWBN AVideo: Reflected XSS in plugin/Meet/iframe.php via Unescaped \`user\`/\`pass\` Parameters Reflected into JavaScript String Literal

- Severity: Medium 6.1
- Published: May 11, 2026
- Affected: through 29.0.

### [CVE-2026-43877](https://cve.now/CVE-2026-43877): WWBN AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Any Logged-in User's Profile Photo with Arbitrary Bytes

- Severity: Medium 5.4
- Published: May 11, 2026
- Affected: through 29.0.

### [CVE-2026-43876](https://cve.now/CVE-2026-43876): WWBN AVideo: HTML Injection in notifySubscribers.json.php Enables Platform-Branded Phishing Emails to Channel Subscribers

- Severity: Medium 6.4
- Published: May 11, 2026
- Affected: through 29.0.

### [CVE-2026-43875](https://cve.now/CVE-2026-43875): WWBN AVideo: Password Hash Leaked in MobileManager OAuth Redirect URL Enables Account Takeover

- Severity: Medium 6.8
- Published: May 11, 2026
- Affected: through 29.0.

### [CVE-2026-43873](https://cve.now/CVE-2026-43873): WWBN AVideo: Unauthenticated Disclosure of CloneSite \`myKey\` via Error Echo in \`cloneClient.json.php\` Enables Cross-Site DB Dump of the…

- Severity: High 7.5
- Published: May 11, 2026
- Affected: through 29.0.

### [CVE-2026-43874](https://cve.now/CVE-2026-43874): WWBN AVideo: Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via \`$msg\['json'\]\`…

- Severity: High 7.2
- Published: May 11, 2026
- Affected: through 29.0.

### [CVE-2026-41304](https://cve.now/CVE-2026-41304): WWBN AVideo vulnerable to RCE caused by clonesite plugin

- Severity: High 8.9
- Published: Apr 21, 2026
- Affected: through 29.0.

### [CVE-2026-41064](https://cve.now/CVE-2026-41064): AVideo has an incomplete fix for CVE-2026-33502 (Command Injection)

- Severity: Critical 9.3
- Published: Apr 21, 2026
- Affected: through 29.0.

### [CVE-2026-41063](https://cve.now/CVE-2026-41063): WWBN AVideo has incomplete fix for CVE-2026-33500 (XSS)

- Severity: Medium 5.4
- Published: Apr 21, 2026
- Affected: through 29.0.

### [CVE-2026-41062](https://cve.now/CVE-2026-41062): WWBN/AVideo has an incomplete fix for a directory traversal bypass via query string in ReceiveImage downloadURL parameters

- Severity: Medium 6.5
- Published: Apr 21, 2026
- Affected: through 29.0.

### [CVE-2026-41061](https://cve.now/CVE-2026-41061): WWBN AVideo Vulnerable to stored XSS via Unanchored Duration Regex in Video Encoder Receiver

- Severity: Medium 5.4
- Published: Apr 21, 2026
- Affected: through 29.0.

### [CVE-2026-41060](https://cve.now/CVE-2026-41060): AVideo's SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL

- Severity: High 7.7
- Published: Apr 21, 2026
- Affected: through 29.0.

### [CVE-2026-41058](https://cve.now/CVE-2026-41058): AVideo has an incomplete fix for CVE-2026-33293 (Path Traversal) in AVideo

- Severity: High 8.1
- Published: Apr 21, 2026
- Affected: through 29.0.

### [CVE-2026-41057](https://cve.now/CVE-2026-41057): AVideo has CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) that Exposes Authenticated API Responses

- Severity: High 7.1
- Published: Apr 21, 2026
- Affected: through 29.0.

### [CVE-2026-41056](https://cve.now/CVE-2026-41056): AVideos has CORS Origin Reflection with Credentials on Sensitive API Endpoints that Enables Cross-Origin Account Takeover

- Severity: High 8.1
- Published: Apr 21, 2026
- Affected: through 29.0.

### [CVE-2026-41055](https://cve.now/CVE-2026-41055): AVideo has an incomplete fix for CVE-2026-33039 (SSRF)

- Severity: High 8.6
- Published: Apr 21, 2026
- Affected: through 29.0.

### [CVE-2026-40935](https://cve.now/CVE-2026-40935): WWBN/AVideo has CAPTCHA Bypass via Attacker-Controlled Length Parameter and Missing Token Invalidation on Failure

- Severity: Medium 5.3
- Published: Apr 21, 2026
- Affected: through 29.0.

### [CVE-2026-40929](https://cve.now/CVE-2026-40929): WWBN AVideo's missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content…

- Severity: Medium 5.4
- Published: Apr 21, 2026
- Affected: through 29.0.

### [CVE-2026-40928](https://cve.now/CVE-2026-40928): AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset…

- Severity: Medium 5.4
- Published: Apr 21, 2026
- Affected: through 29.0.

### [CVE-2026-40926](https://cve.now/CVE-2026-40926): WWBN AVideo Vulnerable to CSRF in Admin JSON Endpoints (Category CRUD, Plugin Update Script)

- Severity: High 7.1
- Published: Apr 21, 2026
- Affected: through 29.0.

### [CVE-2026-40925](https://cve.now/CVE-2026-40925): WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials

- Severity: High 8.3
- Published: Apr 21, 2026
- Affected: through 29.0.

### [CVE-2026-40911](https://cve.now/CVE-2026-40911): WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks

- Severity: Critical 10.0
- Published: Apr 21, 2026
- Affected: through 29.0.

### [CVE-2026-40909](https://cve.now/CVE-2026-40909): WWBN AVideo has a Path Traversal in Locale Save Endpoint that Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE)

- Severity: High 8.7
- Published: Apr 21, 2026
- Affected: through 29.0.

### [CVE-2026-40908](https://cve.now/CVE-2026-40908): WWBN AVideo has an Unauthenticated Information Disclosure via git.json.php that Exposes Developer Emails and Deployed Version

- Severity: Medium 5.3
- Published: Apr 21, 2026
- Affected: through 29.0.

### [CVE-2026-40907](https://cve.now/CVE-2026-40907): WWBN AVideo has IDOR in Live Restreams list.json.php that Exposes Other Users' Stream Keys and OAuth Tokens

- Severity: Medium 6.5
- Published: Apr 21, 2026
- Affected: through 29.0.

### [CVE-2026-39370](https://cve.now/CVE-2026-39370): WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration (Incomplete…

- Severity: High 7.1
- Published: Apr 7, 2026
- Affected: through 26.0.

### [CVE-2026-39369](https://cve.now/CVE-2026-39369): WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLs

- Severity: High 7.6
- Published: Apr 7, 2026
- Affected: through 26.0.

### [CVE-2026-39368](https://cve.now/CVE-2026-39368): WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services

- Severity: Medium 6.5
- Published: Apr 7, 2026
- Affected: through 26.0.

### [CVE-2026-39367](https://cve.now/CVE-2026-39367): WWBN AVideo has Stored XSS via Malicious EPG XML Program Titles in AVideo EPG Page

- Severity: Medium 5.4
- Published: Apr 7, 2026
- Affected: through 26.0.

### [CVE-2026-39366](https://cve.now/CVE-2026-39366): WWBN AVideo Affected by a PayPal IPN Replay Attack Enabling Wallet Balance Inflation via Missing Transaction Deduplication in ipn.php

- Severity: Medium 6.5
- Published: Apr 7, 2026
- Affected: through 26.0.

### [CVE-2026-35452](https://cve.now/CVE-2026-35452): WWBN AVideo has Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php

- Severity: Medium 5.3
- Published: Apr 6, 2026
- Affected: through 26.0.

### [CVE-2026-35450](https://cve.now/CVE-2026-35450): WWBN AVideo has Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php

- Severity: Medium 5.3
- Published: Apr 6, 2026
- Affected: through 26.0.

### [CVE-2026-35449](https://cve.now/CVE-2026-35449): WWBN AVideo has Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.php

- Severity: Medium 5.3
- Published: Apr 6, 2026
- Affected: through 26.0.

### [CVE-2026-35448](https://cve.now/CVE-2026-35448): WWBN AVideo Provides Unauthenticated Access to Payment Order Data via BlockonomicsYPT check.php

- Severity: Low 3.7
- Published: Apr 6, 2026
- Affected: through 26.0.

### [CVE-2026-35181](https://cve.now/CVE-2026-35181): WWBN AVideo Affected by CSRF on Player Skin Configuration via admin/playerUpdate.json.php

- Severity: Medium 4.3
- Published: Apr 6, 2026
- Affected: through 26.0.

### [CVE-2026-35179](https://cve.now/CVE-2026-35179): WWBN AVideo Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php

- Severity: Medium 5.3
- Published: Apr 6, 2026
- Affected: through 26.0.

### [CVE-2026-34740](https://cve.now/CVE-2026-34740): AVideo: Stored SSRF via Video EPG Link Missing isSSRFSafeURL() Validation

- Severity: Medium 6.5
- Published: Mar 31, 2026
- Affected: through 26.0.

### [CVE-2026-34739](https://cve.now/CVE-2026-34739): AVideo: Reflected XSS via Unescaped ip Parameter in User\_Location testIP.php

- Severity: Medium 6.1
- Published: Mar 31, 2026
- Affected: through 26.0.

### [CVE-2026-34738](https://cve.now/CVE-2026-34738): AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter

- Severity: Medium 4.3
- Published: Mar 31, 2026
- Affected: through 26.0.

### [CVE-2026-34737](https://cve.now/CVE-2026-34737): AVideo: Arbitrary Stripe Subscription Cancellation via Debug Endpoint and retrieveSubscriptions() Bug

- Severity: Medium 6.5
- Published: Mar 31, 2026
- Affected: through 26.0.

### [CVE-2026-34733](https://cve.now/CVE-2026-34733): AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard

- Severity: Medium 6.5
- Published: Mar 31, 2026
- Affected: through 26.0.

### [CVE-2026-34732](https://cve.now/CVE-2026-34732): AVideo: Missing Authentication in CreatePlugin list.json.php Template Affects 21 Endpoints

- Severity: Medium 5.3
- Published: Mar 31, 2026
- Affected: through 26.0.

### [CVE-2026-34731](https://cve.now/CVE-2026-34731): AVideo: Unauthenticated Live Stream Termination via RTMP Callback on\_publish\_done.php

- Severity: High 7.5
- Published: Mar 31, 2026
- Affected: through 26.0.

### [CVE-2026-34716](https://cve.now/CVE-2026-34716): AVideo: DOM XSS via Unsanitized Display Name in WebSocket Call Notification

- Severity: Medium 6.4
- Published: Mar 31, 2026
- Affected: through 26.0.

### [CVE-2026-34613](https://cve.now/CVE-2026-34613): AVideo: CSRF on Plugin Enable/Disable Endpoint Allows Disabling Security Plugins

- Severity: Medium 6.5
- Published: Mar 31, 2026
- Affected: through 26.0.

### [CVE-2026-34611](https://cve.now/CVE-2026-34611): AVideo: CSRF on emailAllUsers.json.php Enables Mass Phishing Email to All Users

- Severity: Medium 6.5
- Published: Mar 31, 2026
- Affected: through 26.0.

### [CVE-2026-34396](https://cve.now/CVE-2026-34396): AVideo: Stored XSS via Unescaped Plugin Configuration Values in Admin Panel

- Severity: Medium 6.1
- Published: Mar 31, 2026
- Affected: through 26.0.

### [CVE-2026-34394](https://cve.now/CVE-2026-34394): AVideo: CSRF on Admin Plugin Configuration Enables Payment Credential Hijacking

- Severity: High 8.1
- Published: Mar 31, 2026
- Affected: through 26.0.

### [CVE-2026-34395](https://cve.now/CVE-2026-34395): AVideo: Mass User PII Disclosure via Missing Authorization in YPTWallet users.json.php

- Severity: Medium 6.5
- Published: Mar 31, 2026
- Affected: through 26.0.

### [CVE-2026-34375](https://cve.now/CVE-2026-34375): AVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment Page

- Severity: High 8.2
- Published: Mar 27, 2026
- Affected: through 26.0.

### [CVE-2026-34369](https://cve.now/CVE-2026-34369): AVIdeo has Video Password Protection Bypass via API Endpoints Returning Full Playback Sources Without Password Verification

- Severity: Medium 5.3
- Published: Mar 27, 2026
- Affected: through 26.0.

### [CVE-2026-34368](https://cve.now/CVE-2026-34368): AVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalance

- Severity: Medium 5.3
- Published: Mar 27, 2026
- Affected: through 26.0.

### [CVE-2026-34364](https://cve.now/CVE-2026-34364): AVideo has User Group-Based Category Access Control Bypass via Missing and Broken Group Filtering in categories.json.php

- Severity: Medium 5.3
- Published: Mar 27, 2026
- Affected: through 26.0.

### [CVE-2026-34362](https://cve.now/CVE-2026-34362): AVideo's WebSocket Token Never Expires Due to Commented-Out Timeout Validation in verifyTokenSocket()

- Severity: Medium 5.4
- Published: Mar 27, 2026
- Affected: through 26.0.

### [CVE-2026-34247](https://cve.now/CVE-2026-34247): AVideo's IDOR in uploadPoster.php Allows Any Authenticated User to Overwrite Scheduled Live Stream Posters and Trigger False Socket…

- Severity: Medium 5.4
- Published: Mar 27, 2026
- Affected: through 26.0.

### [CVE-2026-34245](https://cve.now/CVE-2026-34245): AVideo's Missing Authorization in Playlist Schedule Creation Allows Cross-User Broadcast Hijacking

- Severity: Medium 6.3
- Published: Mar 27, 2026
- Affected: through 26.0.

### [CVE-2026-33867](https://cve.now/CVE-2026-33867): AVideo has Plaintext Video Password Storage

- Severity: Critical 9.1
- Published: Mar 27, 2026
- Affected: through 26.0.

### [CVE-2026-33770](https://cve.now/CVE-2026-33770): AVideo has SQL Injection in category.php fixCleanTitle() via Unparameterized clean\_title and id Variables

- Severity: High 7.1
- Published: Mar 27, 2026
- Affected: through 26.0.

### [CVE-2026-33767](https://cve.now/CVE-2026-33767): AVideo has SQL Injection via Partial Prepared Statement — videos\_id Concatenated Directly into Query

- Severity: High 7.1
- Published: Mar 27, 2026
- Affected: fixed in 26.0.

### [CVE-2026-33766](https://cve.now/CVE-2026-33766): AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints

- Severity: Medium 5.3
- Published: Mar 27, 2026
- Affected: through 26.0.

### [CVE-2026-33764](https://cve.now/CVE-2026-33764): AVideo: IDOR in AI Plugin Allows Stealing Other Users' AI-Generated Metadata and Transcriptions

- Severity: Medium 4.3
- Published: Mar 27, 2026
- Affected: through 26.0.

### [CVE-2026-33763](https://cve.now/CVE-2026-33763): AVideo has an Unauthenticated Video Password Brute-Force Vulnerability via Unrate-Limited Boolean Oracle

- Severity: Medium 5.3
- Published: Mar 27, 2026
- Affected: through 26.0.

### [CVE-2026-33761](https://cve.now/CVE-2026-33761): AVideo: Unauthenticated Access to Scheduler Plugin Endpoints Leaks Scheduled Tasks, Email Content, and User Mappings

- Severity: Medium 5.3
- Published: Mar 27, 2026
- Affected: through 26.0.

### [CVE-2026-33759](https://cve.now/CVE-2026-33759): AVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist Contents

- Severity: Medium 5.3
- Published: Mar 27, 2026
- Affected: through 26.0.

### [CVE-2026-33723](https://cve.now/CVE-2026-33723): AVideo Vulnerable to SQL Injection in Subscribe Endpoint via Unsanitized user\_id Parameter in subscribe.php

- Severity: High 7.1
- Published: Mar 23, 2026
- Affected: through 26.0.

### [CVE-2026-33719](https://cve.now/CVE-2026-33719): AVideo Vulnerable to Unauthenticated CDN Configuration Takeover via Empty Default Key Bypass and Mass-Assignment in status.json.php

- Severity: High 8.6
- Published: Mar 23, 2026
- Affected: through 26.0.

### [CVE-2026-33717](https://cve.now/CVE-2026-33717): AVideo Vulnerable to Remote Code Execution via Persistent PHP Temp File in Encoder downloadURL with Resolution Validation Abort

- Severity: High 8.8
- Published: Mar 23, 2026
- Affected: through 26.0.

### [CVE-2026-33716](https://cve.now/CVE-2026-33716): AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php

- Severity: Critical 9.4
- Published: Mar 23, 2026
- Affected: through 26.0.

### [CVE-2026-33690](https://cve.now/CVE-2026-33690): AVideo vulnerable to IP Address Spoofing via Untrusted HTTP Headers in getRealIpAddr()

- Severity: Medium 5.3
- Published: Mar 23, 2026
- Affected: through 26.0.

### [CVE-2026-33688](https://cve.now/CVE-2026-33688): AVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery Endpoint

- Severity: Medium 5.3
- Published: Mar 23, 2026
- Affected: through 26.0.

### [CVE-2026-33685](https://cve.now/CVE-2026-33685): AVideo Allows Unauthenticated Access to AD\_Server reports.json.php that Exposes Ad Campaign Analytics and User Data

- Severity: Medium 5.3
- Published: Mar 23, 2026
- Affected: through 26.0.

### [CVE-2026-33683](https://cve.now/CVE-2026-33683): AVideo vulnerable to Stored XSS via html\_entity\_decode() Reversing xss\_esc() Sanitization in Channel About Field

- Severity: Medium 5.4
- Published: Mar 23, 2026
- Affected: through 26.0.

### [CVE-2026-33681](https://cve.now/CVE-2026-33681): AVideo has Path Traversal in pluginRunDatabaseScript.json.php Enables Arbitrary SQL File Execution via Unsanitized Plugin Name

- Severity: High 7.2
- Published: Mar 23, 2026
- Affected: through 26.0.

### [CVE-2026-33651](https://cve.now/CVE-2026-33651): AVideo has a Blind SQL Injection in Live Schedule Reminder via Unsanitized live\_schedule\_id in Scheduler\_commands::getAllActiveOrToRepeat()

- Severity: High 8.1
- Published: Mar 23, 2026
- Affected: through 26.0.

### [CVE-2026-33650](https://cve.now/CVE-2026-33650): AVideo's Video Moderator Privilege Escalation via Ownership Transfer Enables Arbitrary Video Deletion

- Severity: High 7.6
- Published: Mar 23, 2026
- Affected: through 26.0.

### [CVE-2026-33649](https://cve.now/CVE-2026-33649): AVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission Modification

- Severity: High 8.1
- Published: Mar 23, 2026
- Affected: through 26.0.

### [CVE-2026-33648](https://cve.now/CVE-2026-33648): AVideo Vulnerable to OS Command Injection via Unsanitized \`users\_id\` and \`liveTransmitionHistory\_id\` in Restreamer Log File Path

- Severity: High 8.8
- Published: Mar 23, 2026
- Affected: through 26.0.

### [CVE-2026-33647](https://cve.now/CVE-2026-33647): AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload

- Severity: High 8.8
- Published: Mar 23, 2026
- Affected: through 26.0.

### [CVE-2026-33513](https://cve.now/CVE-2026-33513): AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP)

- Severity: High 8.6
- Published: Mar 23, 2026
- Affected: through 26.0.

### [CVE-2026-33512](https://cve.now/CVE-2026-33512): AVideo has an unauthenticated decrypt oracle leaking any ciphertext

- Severity: High 7.5
- Published: Mar 23, 2026
- Affected: through 26.0.

### [CVE-2026-33507](https://cve.now/CVE-2026-33507): AVideo Affected by CSRF on Plugin Import Endpoint Enables Unauthenticated Remote Code Execution via Malicious Plugin Upload

- Severity: High 8.8
- Published: Mar 23, 2026
- Affected: through 26.0.

### [CVE-2026-33502](https://cve.now/CVE-2026-33502): AVideo has Unauthenticated SSRF via plugin/Live/test.php

- Severity: Critical 9.3
- Published: Mar 23, 2026
- Affected: through 26.0.

### [CVE-2026-33501](https://cve.now/CVE-2026-33501): AVideo has Unauthenticated Information Disclosure of User Group Permission Mappings via Permissions Plugin

- Severity: Medium 5.3
- Published: Mar 23, 2026
- Affected: through 26.0.

### [CVE-2026-33500](https://cve.now/CVE-2026-33500): AVideo Vulnerable to Stored XSS via Markdown \`javascript:\` URI Bypasses ParsedownSafeWithLinks Sanitization

- Severity: Medium 5.4
- Published: Mar 23, 2026
- Affected: through 26.0.

### [CVE-2026-33499](https://cve.now/CVE-2026-33499): AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php

- Severity: Medium 6.1
- Published: Mar 23, 2026
- Affected: through 26.0.

### [CVE-2026-33493](https://cve.now/CVE-2026-33493): AVideo has a Path Traversal in import.json.php that Allows Private Video Theft and Arbitrary File Read/Deletion via fileURI Parameter

- Severity: High 7.1
- Published: Mar 23, 2026
- Affected: through 26.0.

### [CVE-2026-33492](https://cve.now/CVE-2026-33492): AVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session Regeneration

- Severity: High 7.3
- Published: Mar 23, 2026
- Affected: through 26.0.

### [CVE-2026-33488](https://cve.now/CVE-2026-33488): AVideo has a PGP 2FA Bypass via Cryptographically Broken 512-bit RSA Key Generation in LoginControl Plugin

- Severity: High 7.4
- Published: Mar 23, 2026
- Affected: through 26.0.

### [CVE-2026-33485](https://cve.now/CVE-2026-33485): AVideo has an Unauthenticated Blind SQL Injection in RTMP on\_publish Callback via Stream Name Parameter

- Severity: High 7.5
- Published: Mar 23, 2026
- Affected: through 26.0.

### [CVE-2026-33483](https://cve.now/CVE-2026-33483): AVideo Affected by Unauthenticated Disk Space Exhaustion via Unlimited Temp File Creation in aVideoEncoderChunk.json.php

- Severity: High 7.5
- Published: Mar 23, 2026
- Affected: through 26.0.

### [CVE-2026-33482](https://cve.now/CVE-2026-33482): AVideo has an OS Command Injection via $() Shell Substitution Bypass in sanitizeFFmpegCommand()

- Severity: High 8.1
- Published: Mar 23, 2026
- Affected: through 26.0.

### [CVE-2026-33480](https://cve.now/CVE-2026-33480): AVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks Proxy

- Severity: High 8.6
- Published: Mar 23, 2026
- Affected: through 26.0.

### [CVE-2026-33479](https://cve.now/CVE-2026-33479): AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin

- Severity: High 8.8
- Published: Mar 23, 2026
- Affected: through 26.0.

### [CVE-2026-33478](https://cve.now/CVE-2026-33478): AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection

- Severity: Critical 10.0
- Published: Mar 23, 2026
- Affected: through 26.0.

### [CVE-2026-33354](https://cve.now/CVE-2026-33354): AVideo has an authenticated arbitrary local file read via \`chunkFile\` path injection in \`aVideoEncoder.json.php\`

- Severity: High 7.6
- Published: Mar 23, 2026
- Affected: through 26.0.

### [CVE-2026-33352](https://cve.now/CVE-2026-33352): AVideo has an Unauthenticated SQL Injection via \`doNotShowCats\` Parameter (Backslash Escape Bypass)

- Severity: Critical 9.8
- Published: Mar 23, 2026
- Affected: through 26.0.

### [CVE-2026-33351](https://cve.now/CVE-2026-33351): AVideo has Unauthenticated SSRF via \`webSiteRootURL\` Parameter in saveDVR.json.php, Chaining to Verification Bypass

- Severity: Critical 9.1
- Published: Mar 23, 2026
- Affected: through 26.0.

### [CVE-2026-33297](https://cve.now/CVE-2026-33297): AVideo has an IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.php

- Severity: Medium 5.1
- Published: Mar 23, 2026
- Affected: through 25.0.

### [CVE-2026-33296](https://cve.now/CVE-2026-33296): AVideo has an Open Redirect via Unvalidated redirectUri in userLogin.php

- Severity: Low 2.1
- Published: Mar 22, 2026
- Affected: through 25.0.

### [CVE-2026-33295](https://cve.now/CVE-2026-33295): AVideo Vulnerable to Stored XSS via Unescaped Video Title in CDN downloadButtons.php

- Severity: High 8.2
- Published: Mar 22, 2026
- Affected: through 25.0.

### [CVE-2026-33294](https://cve.now/CVE-2026-33294): AVideo has SSRF in BulkEmbed Thumbnail Fetch that Allows Reading Internal Network Resources

- Severity: Medium 5.0
- Published: Mar 22, 2026
- Affected: through 25.0.

### [CVE-2026-33293](https://cve.now/CVE-2026-33293): AVideo Affected by Arbitrary File Deletion via Path Traversal in CloneSite deleteDump Parameter

- Severity: High 8.1
- Published: Mar 22, 2026
- Affected: through 25.0.

### [CVE-2026-33319](https://cve.now/CVE-2026-33319): AVideo Vulnerable to OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command

- Severity: Medium 5.9
- Published: Mar 22, 2026
- Affected: through 25.0.

### [CVE-2026-33292](https://cve.now/CVE-2026-33292): AVideo has Authorization Bypass via Path Traversal in HLS Endpoint Allows Streaming Private/Paid Videos

- Severity: High 7.5
- Published: Mar 22, 2026
- Affected: through 25.0.

### [CVE-2026-33238](https://cve.now/CVE-2026-33238): AVideo has a Path Traversal in listFiles.json.php that Enables Server Filesystem Enumeration

- Severity: Medium 4.3
- Published: Mar 20, 2026
- Affected: fixed in 26.0.

### [CVE-2026-33237](https://cve.now/CVE-2026-33237): AVideo has SSRF in Scheduler Plugin via callbackURL Missing \`isSSRFSafeURL()\` Validation

- Severity: Medium 5.5
- Published: Mar 20, 2026
- Affected: fixed in 26.0.

### [CVE-2026-33043](https://cve.now/CVE-2026-33043): AVideo affected by Session Hijacking via Unauthenticated Session ID Disclosure with Permissive CORS

- Severity: High 8.1
- Published: Mar 20, 2026
- Affected: through 25.0.

### [CVE-2026-33041](https://cve.now/CVE-2026-33041): AVideo has an Unauthenticated Password Hash Oracle via encryptPass.json.php

- Severity: Medium 5.3
- Published: Mar 20, 2026
- Affected: through 25.0.

### [CVE-2026-33039](https://cve.now/CVE-2026-33039): AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy

- Severity: High 8.6
- Published: Mar 20, 2026
- Affected: through 25.0.

### [CVE-2026-33038](https://cve.now/CVE-2026-33038): AVideo affected by unauthenticated application takeover via exposed web installer on uninitialized deployments

- Severity: High 8.1
- Published: Mar 20, 2026
- Affected: through 25.0.

### [CVE-2026-33035](https://cve.now/CVE-2026-33035): Unauthenticated Reflected XSS via innerHTML in AVideo

- Severity: Medium 5.3
- Published: Mar 20, 2026
- Affected: through 25.0.

### [CVE-2026-30885](https://cve.now/CVE-2026-30885): WWBN AVideo - Unauthenticated IDOR - Playlist Information Disclosure

- Severity: Medium 5.5
- Published: Mar 9, 2026
- Affected: fixed in 25.0.

### [CVE-2026-29058](https://cve.now/CVE-2026-29058): AVideo: Unauthenticated OS Command Injection via base64Url in objects/getImage.php

- Severity: Critical 9.8
- Published: Mar 6, 2026
- Affected: fixed in 7.0.0.

### [CVE-2026-28501](https://cve.now/CVE-2026-28501): WWBN AVideo: Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php

- Severity: Critical 9.8
- Published: Mar 6, 2026
- Affected: through 21.0.0.

### [CVE-2026-28502](https://cve.now/CVE-2026-28502): WWBN AVideo: Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction

- Severity: Critical 9.3
- Published: Mar 6, 2026
- Affected: all versions.

### [CVE-2026-29093](https://cve.now/CVE-2026-29093): WWBN AVideo: Unauthenticated PHP session store exposed to host network via published memcached port

- Severity: High 8.1
- Published: Mar 6, 2026
- Affected: through 21.0.

### [CVE-2026-27732](https://cve.now/CVE-2026-27732): AVideo has Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.php

- Severity: High 8.6
- Published: Feb 24, 2026
- Affected: fixed in 22.0.

### [CVE-2026-27568](https://cve.now/CVE-2026-27568): AVideo has Stored Cross-Site Scripting via Markdown Comment Injection

- Severity: Medium 5.1
- Published: Feb 24, 2026
- Affected: fixed in 21.0.

### [CVE-2024-34899](https://cve.now/CVE-2024-34899): WWBN AVideo 12.4 is vulnerable to Cross Site Scripting (XSS).

- Severity: Medium 5.4
- Published: May 13, 2024
- Affected: fixed in 14.3.

### [CVE-2024-31819](https://cve.now/CVE-2024-31819): An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath parameter of the…

- Severity: Critical 9.8
- Published: Apr 10, 2024
- Affected: from 12.4, fixed in 14.3.

### [CVE-2023-50172](https://cve.now/CVE-2023-50172): A recovery notification bypass vulnerability exists in the userRecoverPass.php captcha validation functionality of WWBN AVideo dev master…

- Severity: Medium 5.3
- Published: Jan 10, 2024
- Affected: through 12.4.

### [CVE-2023-49810](https://cve.now/CVE-2023-49810): A login attempt restriction bypass vulnerability exists in the checkLoginAttempts functionality of WWBN AVideo dev master commit 15fed957fb.

- Severity: High 7.3
- Published: Jan 10, 2024
- Affected: through 12.4.

### [CVE-2023-49599](https://cve.now/CVE-2023-49599): An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed957fb.

- Severity: Critical 9.8
- Published: Jan 10, 2024
- Affected: through 12.4.

### [CVE-2023-32073](https://cve.now/CVE-2023-32073): AVideo command injection vulnerability

- Severity: High 8.8
- Published: May 12, 2023
- Affected: through 12.4.

### [CVE-2023-30860](https://cve.now/CVE-2023-30860): WWBN/AVideo stored XSS vulnerability leads to takeover of any user's account, including admin's account

- Severity: High 8.0
- Published: May 8, 2023
- Affected: fixed in 12.4.

### [CVE-2023-30854](https://cve.now/CVE-2023-30854): WWBN AVideo vulnerable to OS Command Injection

- Severity: High 8.8
- Published: Apr 28, 2023
- Affected: fixed in 12.4.

### [CVE-2023-25313](https://cve.now/CVE-2023-25313): OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbitrary code via the…

- Severity: Critical 9.8
- Published: Apr 25, 2023
- Affected: fixed in 12.4.

### [CVE-2022-27463](https://cve.now/CVE-2022-27463): Open redirect vulnerability in objects/login.json.php in WWBN AVideo through 11.6, allows attackers to arbitrarily redirect users from a…

- Severity: Unrated
- Published: Apr 5, 2022
- Affected: through 11.6.

### [CVE-2020-23489](https://cve.now/CVE-2020-23489): The import.json.php file before 8.9 for Avideo is vulnerable to a File Deletion vulnerability.

- Severity: Unrated
- Published: Nov 16, 2020
- Affected: fixed in 8.9.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/packagist/wwbn/avideo
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.