WWBN AVideo

• CVE-2026-85156 Medium 5.3 WWBN AVideo Broken Access Control via Channel Page 0.3%
• CVE-2026-85155 High 7.5 WWBN AVideo SQL Injection via get.json.php APIName channels 0.5%
• CVE-2026-85154 Critical 9.8 WWBN AVideo Authentication Bypass via Non-Expiring video_id_hash 0.6%
• CVE-2026-84483 Medium 5.3 WWBN AVideo Unauthenticated Password Hash Oracle via encryptPass.json.php 0.4%
• CVE-2026-84482 High 8.8 WWBN AVideo Cross-Site Request Forgery via get_domain() validation 0.2%
• CVE-2026-84481 Medium 6.9 WWBN AVideo through 30.0 Information Disclosure via MobileManager 0.4%
• CVE-2026-84480 Critical 9.8 WWBN AVideo Password Recovery Token Expiration Bypass 0.5%
• CVE-2026-84479 Critical 9.1 WWBN AVideo Authentication Bypass via User-Agent Header 0.5%
• CVE-2026-84478 High 7.3 WWBN AVideo Unauthenticated Arbitrary Log File Deletion 0.6%
• CVE-2026-84477 Medium 5.4 AVideo Stored XSS via Live Schedule Title Description 0.3%
• CVE-2026-84476 High 7.5 WWBN AVideo Authentication Bypass via X-Real-IP Header 0.4%
• CVE-2026-84208 High 7.5 AVideo User_Location Plugin Unauthenticated SQL Injection 0.5%
• CVE-2026-84187 High 8.2 AVideo on_publish.php Missing Authentication Check via RTMP Callback 0.5%
• CVE-2026-83595 High 8.1 AVideo Cross-Site Request Forgery via plugin/API/set.json.php 0.2%
• CVE-2026-82648 High 7.1 WWBN AVideo SSRF Filter Bypass via NAT64 Hex Address 0.3%
• CVE-2026-82647 Medium 6.1 WWBN AVideo Cross-Site Request Forgery via sendEmail.json.php 0.1%
• CVE-2026-82646 Medium 6.1 WWBN AVideo Unauthenticated Reflected XSS via url2Embed.json.php 0.3%
• CVE-2026-82645 High 8.6 AVideo Unauthenticated Stream Credential Disclosure via Forgeable Token 0.2%
• CVE-2026-82644 High 7.5 WWBN AVideo Brute-force Rate Limiting Bypass via Missing User-Agent 0.4%
• CVE-2026-82643 Medium 6.5 WWBN AVideo Unauthenticated Rate Limit Bypass via preauthorize.json.php 0.3%
• CVE-2026-81733 Medium 5.1 WWBN AVideo through 30.0 CSRF via myLiveControls.save.json.php 0.2%
• CVE-2026-81732 Medium 6.9 WWBN AVideo through 30.0 Information Disclosure via report4.json.php 0.6%
• CVE-2026-81678 High 7.5 AVideo SSRF Guard Bypass via IPv6 Transition Addresses 0.4%
• CVE-2026-59808 High 8.8 AVideo Authentication Bypass via Unkeyed Video Hash Disclosure 0.4%
• CVE-2026-59256 High 7.5 WWBN AVideo Unbound Token Authorization Bypass via Gallery 0.3%
• CVE-2026-58003 High 7.1 WWBN AVideo Cross-Site Request Forgery via releaseVideoNow.json.php 0.1%
• CVE-2026-58002 Medium 6.5 WWBN AVideo Authorization Bypass via Users_affiliations add.json.php 0.2%
• CVE-2026-58001 Medium 5.7 WWBN AVideo Cross-Site Request Forgery via videoEditLight.php 0.2%
• CVE-2026-57944 Medium 5.4 AVideo channelToGallery.json.php Cross-Site Request Forgery 0.1%
• CVE-2026-56380 Medium 5.3 AVideo feed/index.php Exposure of Channel Owner Email Address 0.3%
• CVE-2026-72748 Critical 9.1 AVideo Unauthenticated Arbitrary File Write via aVideoEncoderChunk.json.php 1.2%
• CVE-2026-72747 High 7.2 AVideo Stored Cross-Site Scripting via Unauthenticated Registration 0.4%
• CVE-2026-64626 Medium 6.4 AVideo Encoder downloadURL SSRF via unpinned retry fallback 0.2%
• CVE-2026-64625 Critical 9.8 AVideo before 29.0 OS Command Injection via execAsync 0.6%
• CVE-2026-33731 Medium 6.5 AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data 0.2%
• CVE-2026-55173 High 8.1 AVideo incomplete fix for CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command execution at the same execAsync sh -c sink 2.7%
• CVE-2026-33692 High 7.5 AVideo Has Unauthenticated .env File Exposure via Official Docker Compose Configuration 0.3%
• CVE-2026-63305 High 8.1 AVideo through 29.0 OS Command Injection via ffmpeg.json.php 1.8%
• CVE-2026-63304 High 8.1 AVideo through 29.0 OS Command Injection via listFFmpegProcesses 1.7%
• CVE-2026-54458 Critical 9.6 AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin 0.4%
• CVE-2026-50183 Medium 4.7 WWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery Section 0.2%
• CVE-2026-50182 Medium 6.1 AVideo Has Unauthenticated Reflected XSS via $_GET['search'] in YouTubeAPI Gallery Pagination 0.2%
• CVE-2026-49279 High 7.7 WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass) 0.4%
• CVE-2026-33684 Medium 5.3 AVideo's Privilege AVideo: Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet Permissions 0.2%
• CVE-2026-56347 Medium 6.1 AVideo TopMenu Plugin - Stored Cross-Site Scripting via Unescaped Menu Item Fields 0.2%
• CVE-2026-45580 Medium 5.4 WWBN AVideo Live: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute 0.1%
• CVE-2026-45578 High 8.8 WWBN AVideo Live: OS command injection in on_publish.php execAsync via unescaped m3u8 URL 0.3%
• CVE-2026-45610 Medium 5.7 WWBN AVideo plugin/LoginControl/set.json.php: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA 0.1%
• CVE-2026-45619 Medium 6.5 AVideo CVE-2026-43884 incomplete fix - `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD post 0.1%
• CVE-2026-45620 Medium 5.3 AVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumeration 0.2%