Skip to contentWwbn Avideo vulnerabilities
- wwbn avideoWWBN AVideo Vulnerable to CSRF in Admin JSON Endpoints (Category CRUD, Plugin Update Script)CVE-2026-409267.1 High
- wwbn avideoWWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP CredentialsCVE-2026-409258.3 High
- wwbn avideoWWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() SinksCVE-2026-4091110.0 Critical
- wwbn avideoWWBN AVideo has a Path Traversal in Locale Save Endpoint that Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE)CVE-2026-409098.7 High
- wwbn avideoWWBN AVideo has an Unauthenticated Information Disclosure via git.json.php that Exposes Developer Emails and Deployed VersionCVE-2026-409085.3 Medium
- wwbn avideoWWBN AVideo has IDOR in Live Restreams list.json.php that Exposes Other Users' Stream Keys and OAuth TokensCVE-2026-409076.5 Medium
- wwbn avideoWWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration (Incomplete fix for CVE-2026-27732)CVE-2026-393707.1 High
- wwbn avideoWWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLsCVE-2026-393697.6 High
- wwbn avideoWWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal servicesCVE-2026-393686.5 Medium
- wwbn avideoWWBN AVideo has Stored XSS via Malicious EPG XML Program Titles in AVideo EPG PageCVE-2026-393675.4 Medium
- wwbn avideoWWBN AVideo Affected by a PayPal IPN Replay Attack Enabling Wallet Balance Inflation via Missing Transaction Deduplication in ipn.phpCVE-2026-393666.5 Medium
- wwbn avideoWWBN AVideo affected by CSRF on Site Customization Endpoint Enables Logo Overwrite via Base64 File WriteCVE-2026-351804.3 Medium
- wwbn avideoWWBN AVideo has Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.phpCVE-2026-354525.3 Medium
- wwbn avideoWWBN AVideo has Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.phpCVE-2026-354505.3 Medium
- wwbn avideoWWBN AVideo has Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.phpCVE-2026-354495.3 Medium
- wwbn avideoWWBN AVideo Provides Unauthenticated Access to Payment Order Data via BlockonomicsYPT check.phpCVE-2026-354483.7 Low
- wwbn avideoWWBN AVideo Affected by CSRF on Player Skin Configuration via admin/playerUpdate.json.phpCVE-2026-351814.3 Medium
- wwbn avideoWWBN AVideo Unauthenticated Instagram Graph API Proxy via publishInstagram.json.phpCVE-2026-351795.3 Medium
- wwbn avideoAVideo TopMenu Plugin - Stored Cross-Site Scripting via Unescaped Menu Item FieldsCVE-2026-563475.3 Medium
- wwbn avideoAVideo: Stored SSRF via Video EPG Link Missing isSSRFSafeURL() ValidationCVE-2026-347406.5 Medium
- wwbn avideoAVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.phpCVE-2026-347396.1 Medium
- wwbn avideoAVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request ParameterCVE-2026-347384.3 Medium
- wwbn avideoAVideo: Arbitrary Stripe Subscription Cancellation via Debug Endpoint and retrieveSubscriptions() BugCVE-2026-347376.5 Medium
- wwbn avideoAVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI GuardCVE-2026-347336.5 Medium
- wwbn avideoAVideo: Missing Authentication in CreatePlugin list.json.php Template Affects 21 EndpointsCVE-2026-347325.3 Medium
- wwbn avideoAVideo: Unauthenticated Live Stream Termination via RTMP Callback on_publish_done.phpCVE-2026-347317.5 High
- wwbn avideoAVideo: DOM XSS via Unsanitized Display Name in WebSocket Call NotificationCVE-2026-347166.4 Medium
- wwbn avideoAVideo: CSRF on Plugin Enable/Disable Endpoint Allows Disabling Security PluginsCVE-2026-346136.5 Medium
- wwbn avideoAVideo: CSRF on emailAllUsers.json.php Enables Mass Phishing Email to All UsersCVE-2026-346116.5 Medium
- wwbn avideoAVideo: Stored XSS via Unescaped Plugin Configuration Values in Admin PanelCVE-2026-343966.1 Medium
- wwbn avideoAVideo: CSRF on Admin Plugin Configuration Enables Payment Credential HijackingCVE-2026-343948.1 High
- wwbn avideoAVideo: Mass User PII Disclosure via Missing Authorization in YPTWallet users.json.phpCVE-2026-343956.5 Medium
- avideoAVideo - Unauthenticated Access to Payment Log DataTables Endpoints via list.json.phpCVE-2026-563418.7 High
- wwbn avideoAVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment PageCVE-2026-343758.2 High
- wwbn avideoAVideo has SQL Injection in Live_schedule::keyExists() via Unparameterized Stream KeyCVE-2026-343749.1 Critical
- wwbn avideoAVIdeo has Video Password Protection Bypass via API Endpoints Returning Full Playback Sources Without Password VerificationCVE-2026-343695.3 Medium
- wwbn avideoAVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalanceCVE-2026-343685.3 Medium
- wwbn avideoAVideo has User Group-Based Category Access Control Bypass via Missing and Broken Group Filtering in categories.json.phpCVE-2026-343645.3 Medium
- wwbn avideoAVideo's WebSocket Token Never Expires Due to Commented-Out Timeout Validation in verifyTokenSocket()CVE-2026-343625.4 Medium
- wwbn avideoAVideo's IDOR in uploadPoster.php Allows Any Authenticated User to Overwrite Scheduled Live Stream Posters and Trigger False Socket NotificationsCVE-2026-342475.4 Medium
- wwbn avideoAVideo's Missing Authorization in Playlist Schedule Creation Allows Cross-User Broadcast HijackingCVE-2026-342456.3 Medium
- wwbn avideoAVideo has Plaintext Video Password StorageCVE-2026-338679.1 Critical
- wwbn avideoAVideo has SQL Injection in category.php fixCleanTitle() via Unparameterized clean_title and id VariablesCVE-2026-337707.1 High
- wwbn avideoAVideo has SQL Injection via Partial Prepared Statement — videos_id Concatenated Directly into QueryCVE-2026-33767Fix available7.1 High
- wwbn avideoAVideo has SSRF Protection Bypass via HTTP Redirect in Image Download EndpointsCVE-2026-337665.3 Medium
- wwbn avideoAVideo: IDOR in AI Plugin Allows Stealing Other Users' AI-Generated Metadata and TranscriptionsCVE-2026-337644.3 Medium
- wwbn avideoAVideo has an Unauthenticated Video Password Brute-Force Vulnerability via Unrate-Limited Boolean OracleCVE-2026-337635.3 Medium
- wwbn avideoAVideo: Unauthenticated Access to Scheduler Plugin Endpoints Leaks Scheduled Tasks, Email Content, and User MappingsCVE-2026-337615.3 Medium
- wwbn avideoAVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist ContentsCVE-2026-337595.3 Medium
- wwbn avideoAVideo Vulnerable to SQL Injection in Subscribe Endpoint via Unsanitized user_id Parameter in subscribe.phpCVE-2026-337237.1 High
- Show moreLoading…