Vulnerabilities
Last updated 3 hours ago
| Package | Summary | Severity | Published | Modified |
|---|---|---|---|---|
WWBN/AVideo
|
WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin | Critical 9.6 | 4 months ago | 1 day ago |
|
wwbn/avideo
|
AVideo has Unauthenticated PGP Message Decryption via Public Endpoint | Medium Risk 6.0 | 7 months ago | 1 month ago |
|
wwbn/avideo
|
AVideo Vulnerable to Unauthenticated .env File Exposure via Official Docker Compose Configuration | High Risk 7.5 | 4 months ago | 1 month ago |
|
wwbn/avideo
|
AVideo's Privilege Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet Permissions | Medium Risk 5.3 | 4 months ago | 1 month ago |
|
WWBN/AVideo
|
WWBN AVideo: Stored XSS via unescaped Gallery category description | Medium Risk 5.4 | 4 months ago | 1 month ago |
|
wwbn/avideo
|
WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass) | High Risk 8.0 | 4 months ago | 1 month ago |
|
WWBN/AVideo
|
AVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumeration sibling that survives `d9cdc7024` | Medium Risk 5.3 | 5 months ago | 1 month ago |
|
WWBN/AVideo
|
AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php` | Medium Risk 5.3 | 5 months ago | 1 month ago |
|
WWBN/AVideo
|
AVideo: OS command injection in on_publish.php execAsync via unescaped m3u8 URL | High Risk 8.8 | 5 months ago | 1 month ago |
|
WWBN/AVideo
|
AVideo: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute | Medium Risk 5.4 | 5 months ago | 1 month ago |
|
WWBN/AVideo
|
AVideo: Authenticated Arbitrary File Read in view/update.php | Medium Risk 4.9 | 5 months ago | 1 month ago |
|
WWBN/AVideo
|
WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services | Medium Risk 6.5 | 6 months ago | 1 month ago |
|
WWBN/AVideo
|
AVideo's Meet plugin: `uploadRecordedVideo.json.php` derives `users_id` from the uploaded filename and calls passwordless `User->login()`, allowing any caller with the Meet shared secret to obtain a session as arbitrary users including admin | High Risk 8.1 | 5 months ago | 1 month ago |
|
wwbn/avideo
|
AVideo has an incomplete fix of CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command execution at the same execAsync sh -c sink | High Risk 8.1 | 4 months ago | 1 month ago |
|
WWBN/AVideo
|
WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint | Medium Risk 4.3 | 4 months ago | 1 month ago |
|
wwbn/avideo
|
AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data | Medium Risk 6.5 | 4 months ago | 1 month ago |
|
WWBN/AVideo
|
WWBN AVideo: Unauthenticated Reflected XSS via $_GET['search'] in AVideo YouTubeAPI Gallery Pagination | Medium Risk 6.1 | 4 months ago | 1 month ago |
|
WWBN/AVideo
|
WWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery Section | Medium Risk 4.7 | 4 months ago | 1 month ago |
|
wwbn/avideo
|
AVideo Meet plugin: anonymous-to-admin stored XSS via unescaped participant User-Agent in getMeetInfo.json.php Participants panel | Medium Risk 6.0 | 4 months ago | 1 month ago |
|
WWBN/AVideo
|
AVideo CVE-2026-43884 incomplete fix - six (or more) `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD post-`603e7bf` | Medium Risk 6.5 | 5 months ago | 1 month ago |
|
WWBN/AVideo
|
AVideo: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA | Medium Risk 5.7 | 5 months ago | 1 month ago |
|
WWBN/AVideo
|
WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLs | High Risk 7.6 | 6 months ago | 1 month ago |
|
WWBN/AVideo
|
WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration (Incomplete fix for CVE-2026-27732) | High Risk 7.1 | 6 months ago | 1 month ago |
|
wwbn/avideo
|
AVideo has Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction | Critical 9.5 | 8 months ago | 1 month ago |
|
wwbn/avideo
|
WWBN AVideo command injection vulnerability | High Risk 8.8 | 3 years ago | 1 month ago |
|
wwbn/avideo
|
Remote code injection in wwbn/avideo | High Risk 8.8 | 3 years ago | 1 month ago |
|
wwbn/avideo
|
AVideo: Unauthenticated Access to Payment Log DataTables Endpoints Exposes Transaction Data, PayPal Tokens, and User Financial Records | High Risk 7.5 | 7 months ago | 1 month ago |
|
wwbn/avideo
|
AVideo has Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.php | High Risk 8.1 | 8 months ago | 1 month ago |
|
wwbn/avideo
|
WWBN AVideo has an incomplete fix for CVE-2026-33293: Path Traversal | High Risk 8.1 | 6 months ago | 3 months ago |
|
wwbn/avideo
|
WWBN AVideo has an incomplete fix for CVE-2026-33039: SSRF | Medium Risk 5.3 | 6 months ago | 3 months ago |
|
wwbn/avideo
|
AVideo Affected by Arbitrary File Deletion via Path Traversal in CloneSite deleteDump Parameter | High Risk 8.1 | 7 months ago | 3 months ago |
|
wwbn/avideo
|
AVideo - Incomplete Fix for CVE-2026-27568: Stored XSS via Markdown `javascript:` URI Bypasses ParsedownSafeWithLinks Sanitization | Medium Risk 5.4 | 7 months ago | 3 months ago |
|
wwbn/avideo
|
AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy | High Risk 8.6 | 7 months ago | 3 months ago |
|
wwbn/avideo
|
WWBN AVideo has an Incomplete fix: Directory traversal bypass via query string in ReceiveImage downloadURL parameters | Medium Risk 6.5 | 6 months ago | 3 months ago |
|
wwbn/avideo
|
WWBN AVideo has an incomplete fix for CVE-2026-33500: XSS | Medium Risk 5.4 | 6 months ago | 3 months ago |
|
wwbn/avideo
|
AVideo has SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL() | High Risk 7.7 | 5 months ago | 3 months ago |
|
wwbn/avideo
|
WWBN AVideo has an incomplete fix for CVE-2026-33502: Command Injection | Critical 9.3 | 6 months ago | 3 months ago |
|
wwbn/avideo
|
AVideo has Unauthenticated SSRF via plugin/Live/test.php | Critical 9.3 | 7 months ago | 3 months ago |
|
wwbn/avideo
|
AVideo has Stored XSS via Unescaped Menu Item Fields in TopMenu Plugin | Medium Risk 6.1 | 7 months ago | 3 months ago |
|
wwbn/avideo
|
AVideo contains Command injection when embedding a video link | Critical 9.6 | 3 years ago | 3 months ago |
|
wwbn/avideo
|
AVideo Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization | High Risk 8.0 | 5 months ago | 5 months ago |
|
wwbn/avideo
|
AVideo: Password Hash Leak in MobileManager OAuth Redirect URL Enables Account Takeover | Medium Risk 6.8 | 5 months ago | 5 months ago |
|
wwbn/avideo
|
AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Enables Phishing from the Site’s Legitimate From Address | Medium Risk 5.3 | 5 months ago | 5 months ago |
|
wwbn/avideo
|
AVideo: Unauthenticated User Enumeration in objects/users.json.php via isCompany Parameter Allows Bypass of the Admin-Only Listing Restriction | Medium Risk 5.3 | 5 months ago | 5 months ago |
|
wwbn/avideo
|
AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone Server | High Risk 7.5 | 5 months ago | 5 months ago |
|
wwbn/avideo
|
AVideo has Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT_FOLLOWLOCATION Redirect Bypass | Medium Risk 5.4 | 5 months ago | 5 months ago |
|
wwbn/avideo
|
Video: Reflected XSS in plugin/Meet/iframe.php via Unescaped user and pass Parameters in JavaScript String Literal | Medium Risk 6.1 | 5 months ago | 5 months ago |
|
wwbn/avideo
|
AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event Spoofing | Medium Risk 4.3 | 5 months ago | 5 months ago |
|
wwbn/avideo
|
AVideo has an Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']` Relay Bypass | High Risk 7.2 | 5 months ago | 5 months ago |
|
wwbn/avideo
|
AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Authenticated Users' Profile Photos with Arbitrary Content | Medium Risk 5.4 | 5 months ago | 5 months ago |
Page 1