WWBN AVideo any version

AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection

WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks

An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath parameter of the submitIndex.php component.

WWBN AVideo vulnerable to RCE caused by clonesite plugin

WWBN AVideo: Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php

OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbitrary code via the video link field to the Embed a video link feature.

WWBN AVideo: Unauthenticated PHP session store exposed to host network via published memcached port

AVideo has SQL Injection in category.php fixCleanTitle() via Unparameterized clean_title and id Variables

AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass)

AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php

WWBN AVideo: Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction

AVideo has an incomplete fix for CVE-2026-33502 (Command Injection)

AVideo < 20.1 ImageGallery Plugin Unauthenticated File Upload and Deletion

AVideo has Unauthenticated SSRF via plugin/Live/test.php

AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass

AVideo has SQL Injection in Live_schedule::keyExists() via Unparameterized Stream Key

AVideo has an IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.php

AVideo has Plaintext Video Password Storage

AVideo command injection vulnerability

WWBN AVideo vulnerable to OS Command Injection

The import.json.php file before 8.9 for Avideo is vulnerable to a File Deletion vulnerability. This allows the deletion of configuration.php, which leads to certain privilege checks not being in place, and therefore a user can escalate privileges to admin.

AVideo Vulnerable to OS Command Injection via Unsanitized `users_id` and `liveTransmitionHistory_id` in Restreamer Log File Path

AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload

Authorization Bypass in AVideo Platform

AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin

AVideo has SQL Injection via Partial Prepared Statement — videos_id Concatenated Directly into Query

AVideo Vulnerable to Remote Code Execution via Persistent PHP Temp File in Encoder downloadURL with Resolution Validation Abort

WWBN AVideo Live: OS command injection in on_publish.php execAsync via unescaped m3u8 URL

AVideo has a Blind SQL Injection in Live Schedule Reminder via Unsanitized live_schedule_id in Scheduler_commands::getAllActiveOrToRepeat()

AVideo < 20.1 IDOR Arbitrary File Upload

AVideo < 20.1 IDOR Arbitrary Comment Image Upload

AVideo Affected by CSRF on Plugin Import Endpoint Enables Unauthenticated Remote Code Execution via Malicious Plugin Upload

AVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission Modification

WWBN AVideo has a Path Traversal in Locale Save Endpoint that Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE)

AVideo < 20.1 IDOR Arbitrary File Deletion

AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP)

AVideo Vulnerable to Unauthenticated CDN Configuration Takeover via Empty Default Key Bypass and Mass-Assignment in status.json.php

AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy

AVideo has an incomplete fix for CVE-2026-33039 (SSRF)

AVideo has Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.php