WWBN/AVideo (Packagist)

AVideo Meet plugin: anonymous-to-admin stored XSS via unescaped participant User-Agent in getMeetInfo.json.php Participants panel

EPSS 0.25%

AVideo has an incomplete fix of CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command execution at the same execAsync sh -c sink

EPSS 2.68%

AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data

EPSS 0.16%

AVideo Vulnerable to Unauthenticated .env File Exposure via Official Docker Compose Configuration

EPSS 0.35%

AVideo's Privilege Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet Permissions

EPSS 0.24%

Duplicate Advisory: AVideo has Unauthenticated PGP Message Decryption via Public Endpoint

Duplicate Advisory: AVideo: Unauthenticated Access to Payment Log DataTables Endpoints Exposes Transaction Data, PayPal Tokens, and User Financial Records

WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin

EPSS 0.38%

WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin

EPSS 0.38%

WWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery Section

EPSS 0.20%

WWBN AVideo: Unauthenticated Reflected XSS via $_GET['search'] in AVideo YouTubeAPI Gallery Pagination

EPSS 0.22%

WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass)

EPSS 0.40%

WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint

EPSS 0.12%

WWBN AVideo: Stored XSS via unescaped Gallery category description

EPSS 0.16%

AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php`

EPSS 0.46%

AVideo: Authenticated Arbitrary File Read in view/update.php

EPSS 0.47%

AVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumeration sibling that survives `d9cdc7024`

EPSS 0.19%

AVideo CVE-2026-43884 incomplete fix - six (or more) `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD post-`603e7bf`

EPSS 0.14%

AVideo: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA

EPSS 0.11%

AVideo: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute

EPSS 0.14%

AVideo: OS command injection in on_publish.php execAsync via unescaped m3u8 URL

EPSS 0.32%

AVideo's Meet plugin: `uploadRecordedVideo.json.php` derives `users_id` from the uploaded filename and calls passwordless `User->login()`, allowing any caller with the Meet shared secret to obtain a session as arbitrary users including admin

EPSS 0.45%

AVideo Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization

EPSS 0.34%

AVideo has SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL()

EPSS 0.35%

AVideo: IDOR in PayPalYPT Plugin Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription Agreements

EPSS 0.20%

AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event Spoofing

EPSS 0.21%

AVideo: Unauthenticated User Enumeration in objects/users.json.php via isCompany Parameter Allows Bypass of the Admin-Only Listing Restriction

EPSS 0.32%

AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Enables Phishing from the Site’s Legitimate From Address

EPSS 0.29%

AVideo has Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT_FOLLOWLOCATION Redirect Bypass

EPSS 0.20%

Video: Reflected XSS in plugin/Meet/iframe.php via Unescaped user and pass Parameters in JavaScript String Literal

EPSS 0.25%

AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Authenticated Users' Profile Photos with Arbitrary Content

EPSS 0.14%

AVideo: HTML Injection in notifySubscribers.json.php Allows Platform-Branded Phishing Emails to Channel Subscribers

EPSS 0.19%

AVideo: Password Hash Leak in MobileManager OAuth Redirect URL Enables Account Takeover

EPSS 0.33%

AVideo has an Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']` Relay Bypass

EPSS 0.29%

AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone Server

EPSS 0.32%

WWBN AVideo: RCE cause by clonesite plugin

EPSS 2.22%

WWBN AVideo has an incomplete fix for CVE-2026-33502: Command Injection

EPSS 0.34%

WWBN AVideo has an incomplete fix for CVE-2026-33500: XSS

EPSS 0.22%

WWBN AVideo has an Incomplete fix: Directory traversal bypass via query string in ReceiveImage downloadURL parameters

EPSS 0.72%

WWBN AVideo has Stored XSS via Unanchored Duration Regex in Video Encoder Receiver

EPSS 0.17%

WWBN AVideo has a SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL

EPSS 0.30%

WWBN AVideo has an incomplete fix for CVE-2026-33293: Path Traversal

EPSS 0.47%

WWBN AVideo has a CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) Exposes Authenticated API Responses

EPSS 0.13%

WWBN AVideo has CORS Origin Reflection with Credentials on Sensitive API Endpoints Enables Cross-Origin Account Takeover

EPSS 0.34%

WWBN AVideo has an incomplete fix for CVE-2026-33039: SSRF

EPSS 0.38%

CAPTCHA Bypass in WWBN/AVideo via Attacker-Controlled Length Parameter and Missing Token Invalidation on Failure

EPSS 0.22%

WWBN AVideo is missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creators

EPSS 0.11%

WWBN AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset Deletion

EPSS 0.11%

WWBN AVideo has Multiple CSRF Vulnerabilities in Admin JSON Endpoints (Category CRUD, Plugin Update Script)

EPSS 0.17%

WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials

EPSS 0.17%

WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks

EPSS 0.65%

WWBN AVideo has a Path Traversal in Locale Save Endpoint Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE)

EPSS 0.66%

WWBN AVideo has an Unauthenticated Information Disclosure via git.json.php Exposes Developer Emails and Deployed Version

EPSS 0.25%

WWBN AVideo has an IDOR in Live Restreams list.json.php Exposes Other Users' Stream Keys and OAuth Tokens

EPSS 0.27%

WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration (Incomplete fix for CVE-2026-27732)

EPSS 0.21%

WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLs

EPSS 0.72%

WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services

EPSS 0.21%

WWBN AVideo has Stored XSS via Malicious EPG XML Program Titles in AVideo EPG Page

EPSS 0.19%

WWBN AVideo Affected by a PayPal IPN Replay Attack Enabling Wallet Balance Inflation via Missing Transaction Deduplication in ipn.php

EPSS 0.17%

AVideo: Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php

EPSS 0.37%

AVideo: Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php

EPSS 0.37%

AVideo: Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.php

EPSS 0.33%

AVideo: Unauthenticated Access to Payment Order Data via BlockonomicsYPT check.php

EPSS 0.32%

AVideo: CSRF on Player Skin Configuration via admin/playerUpdate.json.php

EPSS 0.13%

AVideo: Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php

EPSS 0.21%

AVideo has Stored XSS via Unescaped Menu Item Fields in TopMenu Plugin

EPSS 0.20%

AVideo: Stored SSRF via Video EPG Link Missing isSSRFSafeURL() Validation

EPSS 0.33%

AVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.php

EPSS 0.22%

AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter

EPSS 0.24%

AVideo: Arbitrary Stripe Subscription Cancellation via Debug Endpoint and retrieveSubscriptions() Bug

EPSS 0.29%

AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard

EPSS 0.35%

AVideo: Missing Authentication in CreatePlugin list.json.php Template Affects 21 Endpoints

EPSS 0.38%

AVideo: Unauthenticated Live Stream Termination via RTMP Callback on_publish_done.php

EPSS 0.49%

AVideo: DOM XSS via Unsanitized Display Name in WebSocket Call Notification

EPSS 0.28%

AVideo: CSRF on Plugin Enable/Disable Endpoint Allows Disabling Security Plugins

EPSS 0.21%

AVideo: CSRF on emailAllUsers.json.php Enables Mass Phishing Email to All Users

EPSS 0.16%

AVideo has Stored XSS via Unescaped Plugin Configuration Values in Admin Panel

EPSS 0.23%

AVideo vulnerable to Mass User PII Disclosure via Missing Authorization in YPTWallet users.json.php

EPSS 0.33%

AVideo's CSRF on Admin Plugin Configuration Enables Payment Credential Hijacking

EPSS 0.24%

AVideo: Unauthenticated Access to Payment Log DataTables Endpoints Exposes Transaction Data, PayPal Tokens, and User Financial Records

EPSS 0.46%

AVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment Page

EPSS 0.30%

AVideo has Video Password Protection Bypass via API Endpoints Returning Full Playback Sources Without Password Verification

EPSS 0.39%

AVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalance

EPSS 0.24%

AVideo has User Group-Based Category Access Control Bypass via Missing and Broken Group Filtering in categories.json.php

EPSS 0.33%

AVideo's WebSocket Token Never Expires Due to Commented-Out Timeout Validation in verifyTokenSocket()

EPSS 0.25%

AVideo: IDOR in uploadPoster.php Allows Any Authenticated User to Overwrite Scheduled Live Stream Posters and Trigger False Socket Notifications

EPSS 0.25%

AVideo: Missing Authorization in Playlist Schedule Creation Allows Cross-User Broadcast Hijacking

EPSS 0.25%

AVideo has Plaintext Video Password Storage

EPSS 0.15%

AVideo has SQL Injection in category.php fixCleanTitle() via Unparameterized clean_title and id Variables

EPSS 0.50%

AVideo has SQL Injection via Partial Prepared Statement — videos_id Concatenated Directly into Query

EPSS 0.52%

AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints

EPSS 0.24%

AVideo: IDOR in AI Plugin Allows Stealing Other Users' AI-Generated Metadata and Transcriptions

EPSS 0.22%

AVideo has an Unauthenticated Video Password Brute-Force Vulnerability via Unrate-Limited Boolean Oracle

EPSS 0.33%

AVideo: Unauthenticated Access to Scheduler Plugin Endpoints Leaks Scheduled Tasks, Email Content, and User Mappings

EPSS 0.40%

AVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist Contents

EPSS 0.31%

AVideo: Full-Read SSRF Through Unvalidated statsURL Parameter in plugin/Live/test.php

AVideo is Vulnerable to SQL Injection through Subscribe Endpoint via Unsanitized user_id Parameter

EPSS 0.23%

AVideo: Unauthenticated CDN Configuration Takeover via Empty Default Key Bypass and Mass-Assignment

EPSS 0.36%

AVideo: Remote Code Execution via PHP Temp File in Encoder downloadURL

EPSS 0.40%

AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php

EPSS 0.45%

AVideo vulnerable to IP Address Spoofing via Untrusted HTTP Headers in getRealIpAddr()

EPSS 0.18%

AVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery Endpoint

EPSS 0.28%

AVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User Data

EPSS 0.32%

AVideo vulnerable to Stored XSS via html_entity_decode() Reversing xss_esc() Sanitization in Channel About Field

EPSS 0.18%

AVideo has Path Traversal in pluginRunDatabaseScript.json.php Enables Arbitrary SQL File Execution via Unsanitized Plugin Name

EPSS 0.50%

AVideo has a Blind SQL Injection in Live Schedule Reminder via Unsanitized live_schedule_id in Scheduler_commands::getAllActiveOrToRepeat()

EPSS 0.35%

AVideo: Video Moderator Privilege Escalation via Ownership Transfer Enables Arbitrary Video Deletion

EPSS 0.24%

AVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission Modification

EPSS 0.18%

AVideo Vulnerable to OS Command Injection via Unsanitized `users_id` and `liveTransmitionHistory_id` in Restreamer Log File Path

EPSS 0.64%

AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload

EPSS 0.65%

AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP)

EPSS 0.75%

AVideo has an unauthenticated decrypt oracle leaking any ciphertext

EPSS 0.24%

AVideo Affected by CSRF on Plugin Import Endpoint Enables Unauthenticated Remote Code Execution via Malicious Plugin Upload

EPSS 0.37%

AVideo has Unauthenticated SSRF via plugin/Live/test.php

EPSS 0.45%

AVideo has Unauthenticated Information Disclosure of User Group Permission Mappings via Permissions Plugin

EPSS 0.45%

AVideo - Incomplete Fix for CVE-2026-27568: Stored XSS via Markdown `javascript:` URI Bypasses ParsedownSafeWithLinks Sanitization

EPSS 0.23%

AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php

EPSS 0.24%

AVideo has a Path Traversal in import.json.php Allows Private Video Theft and Arbitrary File Read/Deletion via fileURI Parameter

EPSS 0.34%

AVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session Regeneration

EPSS 0.30%

AVideo has a PGP 2FA Bypass via Cryptographically Broken 512-bit RSA Key Generation in LoginControl Plugin

EPSS 0.26%

AVideo has an Unauthenticated Blind SQL Injection in RTMP on_publish Callback via Stream Name Parameter

EPSS 0.48%

AVideo Affected by Unauthenticated Disk Space Exhaustion via Unlimited Temp File Creation in aVideoEncoderChunk.json.php

EPSS 0.62%

AVideo has an OS Command Injection via $() Shell Substitution Bypass in sanitizeFFmpegCommand()

EPSS 4.28%

AVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks Proxy

EPSS 0.33%

AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin

EPSS 0.54%

AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection

EPSS 13.27%

AVideo has an authenticated arbitrary local file read via `chunkFile` path injection in `aVideoEncoder.json.php`

EPSS 0.26%

AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass)

EPSS 0.52%

AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass

EPSS 0.44%

AVideo: IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.php

EPSS 0.36%

AVideo has an Open Redirect via Unvalidated redirectUri in userLogin.php

EPSS 0.19%

AVideo Affected by Stored XSS via Unescaped Video Title in CDN downloadButtons.php

EPSS 0.22%

AVideo Affected by SSRF in BulkEmbed Thumbnail Fetch Allows Reading Internal Network Resources

EPSS 0.28%

AVideo Affected by Arbitrary File Deletion via Path Traversal in CloneSite deleteDump Parameter

EPSS 0.51%

AVideo has an Authorization Bypass via Path Traversal in HLS Endpoint Allows Streaming Private/Paid Videos

EPSS 0.70%

AVideo has Unauthenticated PGP Message Decryption via Public Endpoint

EPSS 0.61%

AVideo has an OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command

EPSS 0.33%

AVideo has a Path Traversal in listFiles.json.php Enables Server Filesystem Enumeration

EPSS 0.43%

AVideo has SSRF in Scheduler Plugin via callbackURL Missing `isSSRFSafeURL()` Validation

EPSS 0.35%

AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy

EPSS 0.46%

Unauthenticated Reflected XSS via innerHTML in AVideo

EPSS 0.32%

AVideo affected by Session Hijacking via Unauthenticated Session ID Disclosure with Permissive CORS

EPSS 0.35%

AVideo has an Unauthenticated Password Hash Oracle via encryptPass.json.php

EPSS 0.34%

AVideo affected by unauthenticated application takeover via exposed web installer on uninitialized deployments

EPSS 0.51%

AVideo has Unauthenticated IDOR - Playlist Information Disclosure

EPSS 0.39%

AVideo: Unauthenticated PHP session store exposed to host network via published memcached port

EPSS 0.51%

WWBN AVideo is vulnerable to unauthenticated OS Command Injection via base64Url in objects/getImage.php

EPSS 8.82%

AVideo has Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction

EPSS 0.70%

AVideo has Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php

EPSS 1.57%

AVideo has Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.php

EPSS 0.27%

AVideo has Stored Cross-Site Scripting via Markdown Comment Injection

EPSS 0.26%

Duplicate Advisory: AVideo cross-site scripting vulnerability in the view/about.php page

AVideo cross-site scripting vulnerability in the view/about.php page

EPSS 0.46%

WWBN AVideo Remote Code Execution

EPSS 15.63%

WWBN AVideo recovery notification bypass vulnerability

EPSS 0.83%

WWBN AVideo Improper Restriction of Excessive Authentication Attempts vulnerability

EPSS 0.67%

WWBN AVideo Insufficient Entropy vulnerbaility

EPSS 0.96%

WWBN AVideo command injection vulnerability

EPSS 6.46%

WWBN/AVideo stored XSS vulnerability leads to takeover of any user's account, including admin's account

EPSS 0.71%

Remote code injection in wwbn/avideo

EPSS 5.17%

Cross site scripting (XSS) in wwbn/avideo

Duplicate Advisory: AVideo contains Command injection when embedding a video link

AVideo contains Command injection when embedding a video link

EPSS 1.31%

AVideo vulnerable to Improper Privilege Management

EPSS 2.35%

Open redirect in wwbn/avideo

EPSS 0.64%