WWBN AVideo any version

An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary file read.This vulnerability is triggered by the `downloadURL_gifimage` parameter.

An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary file read.This vulnerability is triggered by the `downloadURL_webpimage` parameter.

WWBN/AVideo has an incomplete fix for a directory traversal bypass via query string in ReceiveImage downloadURL parameters

WWBN AVideo has IDOR in Live Restreams list.json.php that Exposes Other Users' Stream Keys and OAuth Tokens

AVideo: Mass User PII Disclosure via Missing Authorization in YPTWallet users.json.php

AVideo: Stored SSRF via Video EPG Link Missing isSSRFSafeURL() Validation

WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services

AVideo: Arbitrary Stripe Subscription Cancellation via Debug Endpoint and retrieveSubscriptions() Bug

AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints

AVideo: CSRF on Plugin Enable/Disable Endpoint Allows Disabling Security Plugins

AVideo CVE-2026-43884 incomplete fix - `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD post

WWBN AVideo Affected by a PayPal IPN Replay Attack Enabling Wallet Balance Inflation via Missing Transaction Deduplication in ipn.php

AVideo: CSRF on emailAllUsers.json.php Enables Mass Phishing Email to All Users

WWBN AVideo plugin/LoginControl/set.json.php: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA

AVideo: DOM XSS via Unsanitized Display Name in WebSocket Call Notification

AVideo's Missing Authorization in Playlist Schedule Creation Allows Cross-User Broadcast Hijacking

Open redirect vulnerability in objects/login.json.php in WWBN AVideo through 11.6, allows attackers to arbitrarily redirect users from a crafted url to the login page.

Cross Site Scripting (XSS) vulnerability in objects/function.php in function getDeviceID in WWBN AVideo through 11.6, via the yptDevice parameter to view/include/head.php.

Cross Site Scripting (XSS) vulnerability in World Wide Broadcast Network AVideo before 12.4, allows attackers to gain sensitive information via the success parameter to /user.

Unauthenticated Reflected XSS via innerHTML in AVideo

AVideo has Stored Cross-Site Scripting via Markdown Comment Injection

AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php

AVideo: Stored XSS via Unescaped Plugin Configuration Values in Admin Panel

AVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.php

AVideo has an Open Redirect via Unvalidated redirectUri in userLogin.php

AVideo < 20.1 Open Redirect via cancelUri Parameter

AVideo < 20.1 Open Redirect via siteRedirectUri Parameter

WWBN AVideo - Unauthenticated IDOR - Playlist Information Disclosure

AVideo has SSRF in Scheduler Plugin via callbackURL Missing `isSSRFSafeURL()` Validation

WWBN AVideo 12.4 is vulnerable to Cross Site Scripting (XSS).

WWBN AVideo has incomplete fix for CVE-2026-33500 (XSS)

AVideo's IDOR in uploadPoster.php Allows Any Authenticated User to Overwrite Scheduled Live Stream Posters and Trigger False Socket Notifications

AVideo's WebSocket Token Never Expires Due to Commented-Out Timeout Validation in verifyTokenSocket()

AVideo Vulnerable to Stored XSS via Markdown `javascript:` URI Bypasses ParsedownSafeWithLinks Sanitization

AVideo vulnerable to Stored XSS via html_entity_decode() Reversing xss_esc() Sanitization in Channel About Field

WWBN AVideo Vulnerable to stored XSS via Unanchored Duration Regex in Video Encoder Receiver

WWBN AVideo: Stored XSS via unescaped Gallery category description

WWBN AVideo has Stored XSS via Malicious EPG XML Program Titles in AVideo EPG Page

WWBN AVideo Live: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute

WWBN AVideo's missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creators