WWBN AVideo any version

AVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks Proxy

WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials

AVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment Page

AVideo Vulnerable to Stored XSS via Unescaped Video Title in CDN downloadButtons.php

AVideo has an OS Command Injection via $() Shell Substitution Bypass in sanitizeFFmpegCommand()

WWBN AVideo has predictable default admin credentials in official Docker deployment path

AVideo has an incomplete fix for CVE-2026-33293 (Path Traversal) in AVideo

AVideo Affected by Arbitrary File Deletion via Path Traversal in CloneSite deleteDump Parameter

AVideo affected by unauthenticated application takeover via exposed web installer on uninitialized deployments

AVideos has CORS Origin Reflection with Credentials on Sensitive API Endpoints that Enables Cross-Origin Account Takeover

AVideo has a Path Traversal in import.json.php that Allows Private Video Theft and Arbitrary File Read/Deletion via fileURI Parameter

AVideo affected by Session Hijacking via Unauthenticated Session ID Disclosure with Permissive CORS

AVideo: CSRF on Admin Plugin Configuration Enables Payment Credential Hijacking

AVideo has a PGP 2FA Bypass via Cryptographically Broken 512-bit RSA Key Generation in LoginControl Plugin

AVideo < 20.1 IDOR Arbitrary Video Rotation

WWBN/AVideo stored XSS vulnerability leads to takeover of any user's account, including admin's account

AVideo's SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL

WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLs

AVideo has an authenticated arbitrary local file read via `chunkFile` path injection in `aVideoEncoder.json.php`

AVideo's Video Moderator Privilege Escalation via Ownership Transfer Enables Arbitrary Video Deletion

There was a local file disclosure vulnerability in AVideo < 8.9 via the proxy streaming. An unauthenticated attacker can exploit this issue to read an arbitrary file on the server. Which could leak database credentials or other sensitive information such as /etc/passwd file.

AVideo < 20.1 User Information Disclosure via Public API

AVideo < 20.1 System Path Disclosure via Public API

AVideo Affected by Unauthenticated Disk Space Exhaustion via Unlimited Temp File Creation in aVideoEncoderChunk.json.php

AVideo: Unauthenticated Live Stream Termination via RTMP Callback on_publish_done.php

AVideo has Authorization Bypass via Path Traversal in HLS Endpoint Allows Streaming Private/Paid Videos

AVideo has an Unauthenticated Blind SQL Injection in RTMP on_publish Callback via Stream Name Parameter

AVideo: Missing Authentication in CreatePlugin list.json.php Template Affects 21 Endpoints

AVideo Vulnerable to OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command

AVideo has an unauthenticated decrypt oracle leaking any ciphertext

AVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session Regeneration

AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard

AVideo has Path Traversal in pluginRunDatabaseScript.json.php Enables Arbitrary SQL File Execution via Unsanitized Plugin Name

WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration (Incomplete fix for CVE-2026-27732)

AVideo Vulnerable to SQL Injection in Subscribe Endpoint via Unsanitized user_id Parameter in subscribe.php

WWBN AVideo Vulnerable to CSRF in Admin JSON Endpoints (Category CRUD, Plugin Update Script)

AVideo has CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) that Exposes Authenticated API Responses

WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint

WWBN AVideo: Authenticated Arbitrary File Read in view/update.php

WWBN AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php`