WWBN/AVideo vulnerabilities (Packagist)
16 vulnerabilities.
WWBN/AVideoPackagistAVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin9.6 CriticalWWBN/AVideoPackagistWWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery Section4.7 MediumWWBN/AVideoPackagistAVideo Has Unauthenticated Reflected XSS via $_GET['search'] in YouTubeAPI Gallery Pagination6.1 MediumWWBN/AVideoPackagistWWBN AVideo: Stored XSS via unescaped Gallery category description5.4 MediumWWBN/AVideoPackagistWWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint7.1 HighWWBN/AVideoPackagistWWBN AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php`6.9 MediumWWBN/AVideoPackagistWWBN AVideo: Authenticated Arbitrary File Read in view/update.php6.9 MediumWWBN/AVideoPackagistAVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumeration5.3 MediumWWBN/AVideoPackagistAVideo CVE-2026-43884 incomplete fix - `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD post6.5 MediumWWBN/AVideoPackagistWWBN AVideo plugin/LoginControl/set.json.php: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA5.7 MediumWWBN/AVideoPackagistWWBN AVideo Live: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute5.4 MediumWWBN/AVideoPackagistWWBN AVideo Live: OS command injection in on_publish.php execAsync via unescaped m3u8 URL8.8 HighWWBN/AVideoPackagistAVideo - Arbitrary User Session Hijacking via Meet Plugin uploadRecordedVideo Endpoint9.2 CriticalWWBN/AVideoPackagistWWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration (Incomplete fix for CVE-2026-27732)7.1 HighWWBN/AVideoPackagistWWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLs7.6 HighWWBN/AVideoPackagistWWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services6.5 Medium