wwbn/avideo vulnerabilities (Packagist)
144 vulnerabilities.
wwbn/avideoPackagistAVideo - Stored Cross-Site Scripting via Unescaped User-Agent in Participants Panel5.1 Mediumwwbn/avideoPackagistAVideo incomplete fix for CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command execution at the same execAsync sh -c sink8.1 Highwwbn/avideoPackagistAVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data6.5 Mediumwwbn/avideoPackagistAVideo Has Unauthenticated .env File Exposure via Official Docker Compose Configuration7.5 Highwwbn/avideoPackagistAVideo's Privilege AVideo: Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet Permissions5.3 Mediumwwbn/avideoPackagistWWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass)7.7 Highwwbn/avideoPackagistWWBN AVideo: Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization7.7 Highwwbn/avideoPackagistWWBN AVideo: SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL()7.7 Highwwbn/avideoPackagistWWBN AVideo: IDOR in PayPalYPT agreementCancel.json.php Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription Agreements4.2 Mediumwwbn/avideoPackagistWWBN AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event Spoofing4.3 Mediumwwbn/avideoPackagistWWBN AVideo: Unauthenticated User Enumeration in `objects/users.json.php` via `isCompany` Parameter Flips `$ignoreAdmin = true` and Defeats Admin-Only Listing Guard5.3 Mediumwwbn/avideoPackagistWWBN AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Allows Phishing from Site's Legitimate From Address5.3 Mediumwwbn/avideoPackagistWWBN AVideo: Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT_FOLLOWLOCATION Redirect Bypass5.4 Mediumwwbn/avideoPackagistWWBN AVideo: Reflected XSS in plugin/Meet/iframe.php via Unescaped `user`/`pass` Parameters Reflected into JavaScript String Literal6.1 Mediumwwbn/avideoPackagistWWBN AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Any Logged-in User's Profile Photo with Arbitrary Bytes5.4 Mediumwwbn/avideoPackagistWWBN AVideo: HTML Injection in notifySubscribers.json.php Enables Platform-Branded Phishing Emails to Channel Subscribers6.4 Mediumwwbn/avideoPackagistWWBN AVideo: Password Hash Leaked in MobileManager OAuth Redirect URL Enables Account Takeover6.8 Mediumwwbn/avideoPackagistWWBN AVideo: Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']` Relay Bypass7.2 Highwwbn/avideoPackagistWWBN AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone Server7.5 Highwwbn/avideoPackagistWWBN AVideo vulnerable to RCE caused by clonesite plugin8.9 Highwwbn/avideoPackagistAVideo has an incomplete fix for CVE-2026-33502 (Command Injection)9.3 Criticalwwbn/avideoPackagistWWBN AVideo has incomplete fix for CVE-2026-33500 (XSS)5.4 Mediumwwbn/avideoPackagistWWBN/AVideo has an incomplete fix for a directory traversal bypass via query string in ReceiveImage downloadURL parameters6.5 Mediumwwbn/avideoPackagistWWBN AVideo Vulnerable to stored XSS via Unanchored Duration Regex in Video Encoder Receiver5.4 Mediumwwbn/avideoPackagistAVideo's SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL7.7 Highwwbn/avideoPackagistAVideo has an incomplete fix for CVE-2026-33293 (Path Traversal) in AVideo8.1 Highwwbn/avideoPackagistAVideo has CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) that Exposes Authenticated API Responses7.1 Highwwbn/avideoPackagistAVideos has CORS Origin Reflection with Credentials on Sensitive API Endpoints that Enables Cross-Origin Account Takeover8.1 Highwwbn/avideoPackagistAVideo has an incomplete fix for CVE-2026-33039 (SSRF)8.6 Highwwbn/avideoPackagistWWBN/AVideo has CAPTCHA Bypass via Attacker-Controlled Length Parameter and Missing Token Invalidation on Failure5.3 Mediumwwbn/avideoPackagistWWBN AVideo's missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creators5.4 Mediumwwbn/avideoPackagistAVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset Deletion5.4 Mediumwwbn/avideoPackagistWWBN AVideo Vulnerable to CSRF in Admin JSON Endpoints (Category CRUD, Plugin Update Script)7.1 Highwwbn/avideoPackagistWWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials8.3 Highwwbn/avideoPackagistWWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks10.0 Criticalwwbn/avideoPackagistWWBN AVideo has a Path Traversal in Locale Save Endpoint that Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE)8.7 Highwwbn/avideoPackagistWWBN AVideo has an Unauthenticated Information Disclosure via git.json.php that Exposes Developer Emails and Deployed Version5.3 Mediumwwbn/avideoPackagistWWBN AVideo has IDOR in Live Restreams list.json.php that Exposes Other Users' Stream Keys and OAuth Tokens6.5 Mediumwwbn/avideoPackagistWWBN AVideo has Stored XSS via Malicious EPG XML Program Titles in AVideo EPG Page5.4 Mediumwwbn/avideoPackagistWWBN AVideo Affected by a PayPal IPN Replay Attack Enabling Wallet Balance Inflation via Missing Transaction Deduplication in ipn.php6.5 Mediumwwbn/avideoPackagistWWBN AVideo has Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php5.3 Mediumwwbn/avideoPackagistWWBN AVideo has Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php5.3 Mediumwwbn/avideoPackagistWWBN AVideo has Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.php5.3 Mediumwwbn/avideoPackagistWWBN AVideo Provides Unauthenticated Access to Payment Order Data via BlockonomicsYPT check.php3.7 Lowwwbn/avideoPackagistWWBN AVideo Affected by CSRF on Player Skin Configuration via admin/playerUpdate.json.php4.3 Mediumwwbn/avideoPackagistWWBN AVideo Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php5.3 Mediumwwbn/avideoPackagistAVideo TopMenu Plugin - Stored Cross-Site Scripting via Unescaped Menu Item Fields5.3 Mediumwwbn/avideoPackagistAVideo: Stored SSRF via Video EPG Link Missing isSSRFSafeURL() Validation6.5 Mediumwwbn/avideoPackagistAVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.php6.1 Mediumwwbn/avideoPackagistAVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter4.3 Medium- Show olderLoading…