wwbn/avideo vulnerabilities (Packagist)
144 vulnerabilities.
wwbn/avideoPackagistAVideo has a PGP 2FA Bypass via Cryptographically Broken 512-bit RSA Key Generation in LoginControl Plugin7.4 Highwwbn/avideoPackagistAVideo has an Unauthenticated Blind SQL Injection in RTMP on_publish Callback via Stream Name Parameter7.5 Highwwbn/avideoPackagistAVideo Affected by Unauthenticated Disk Space Exhaustion via Unlimited Temp File Creation in aVideoEncoderChunk.json.php7.5 Highwwbn/avideoPackagistAVideo has an OS Command Injection via $() Shell Substitution Bypass in sanitizeFFmpegCommand()8.1 Highwwbn/avideoPackagistAVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks Proxy8.6 Highwwbn/avideoPackagistAVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin8.8 Highwwbn/avideoPackagistAVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection10.0 Criticalwwbn/avideoPackagistAVideo has an authenticated arbitrary local file read via `chunkFile` path injection in `aVideoEncoder.json.php`7.6 Highwwbn/avideoPackagistAVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass)9.8 Criticalwwbn/avideoPackagistAVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass9.1 Criticalwwbn/avideoPackagistAVideo has an IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.php5.1 Mediumwwbn/avideoPackagistAVideo has an Open Redirect via Unvalidated redirectUri in userLogin.php2.1 Lowwwbn/avideoPackagistAVideo Vulnerable to Stored XSS via Unescaped Video Title in CDN downloadButtons.php8.2 Highwwbn/avideoPackagistAVideo has SSRF in BulkEmbed Thumbnail Fetch that Allows Reading Internal Network Resources5.0 Mediumwwbn/avideoPackagistAVideo Affected by Arbitrary File Deletion via Path Traversal in CloneSite deleteDump Parameter8.1 Highwwbn/avideoPackagistAVideo has Authorization Bypass via Path Traversal in HLS Endpoint Allows Streaming Private/Paid Videos7.5 Highwwbn/avideoPackagistAVideo - Unauthenticated PGP Message Decryption via decryptMessage.json.php Endpoint6.9 Mediumwwbn/avideoPackagistAVideo Vulnerable to OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command5.9 Mediumwwbn/avideoPackagistAVideo has a Path Traversal in listFiles.json.php that Enables Server Filesystem Enumeration4.3 Mediumwwbn/avideoPackagistAVideo has SSRF in Scheduler Plugin via callbackURL Missing `isSSRFSafeURL()` Validation5.5 Mediumwwbn/avideoPackagistAVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy8.6 Highwwbn/avideoPackagistUnauthenticated Reflected XSS via innerHTML in AVideo5.3 Mediumwwbn/avideoPackagistAVideo affected by Session Hijacking via Unauthenticated Session ID Disclosure with Permissive CORS8.1 Highwwbn/avideoPackagistAVideo has an Unauthenticated Password Hash Oracle via encryptPass.json.php5.3 Mediumwwbn/avideoPackagistAVideo affected by unauthenticated application takeover via exposed web installer on uninitialized deployments8.1 Highwwbn/avideoPackagistWWBN AVideo - Unauthenticated IDOR - Playlist Information Disclosure5.5 Mediumwwbn/avideoPackagistWWBN AVideo: Unauthenticated PHP session store exposed to host network via published memcached port8.1 Highwwbn/avideoPackagistAVideo: Unauthenticated OS Command Injection via base64Url in objects/getImage.php9.8 Criticalwwbn/avideoPackagistWWBN AVideo: Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction9.3 Criticalwwbn/avideoPackagistWWBN AVideo: Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php9.8 Criticalwwbn/avideoPackagistAVideo has Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.php8.6 Highwwbn/avideoPackagistAVideo has Stored Cross-Site Scripting via Markdown Comment Injection5.1 Mediumwwbn/avideoPackagistAVideo cross-site scripting vulnerability in the view/about.php page5.4 Mediumwwbn/avideoPackagistWWBN AVideo Remote Code Execution9.8 Criticalwwbn/avideoPackagistWWBN AVideo recovery notification bypass vulnerability5.3 Mediumwwbn/avideoPackagistWWBN AVideo Improper Restriction of Excessive Authentication Attempts vulnerability7.3 Highwwbn/avideoPackagistWWBN AVideo Insufficient Entropy vulnerbaility9.8 Criticalwwbn/avideoPackagistAVideo command injection vulnerability8.8 Highwwbn/avideoPackagistWWBN/AVideo stored XSS vulnerability leads to takeover of any user's account, including admin's account8.0 Highwwbn/avideoPackagistWWBN AVideo vulnerable to OS Command Injection8.8 Highwwbn/avideoPackagistCross site scripting (XSS) in wwbn/avideoNo scorewwbn/avideoPackagistAVideo contains Command injection when embedding a video link9.8 Criticalwwbn/avideoPackagistOpen redirect in wwbn/avideo6.1 Mediumwwbn/avideoPackagistAVideo vulnerable to Improper Privilege Management8.8 High