WWBN AVideo

• CVE-2026-34738 Medium 4.3 AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter 0.2%
• CVE-2026-34737 Medium 6.5 AVideo: Arbitrary Stripe Subscription Cancellation via Debug Endpoint and retrieveSubscriptions() Bug 0.3%
• CVE-2026-34733 Medium 6.5 AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard 0.3%
• CVE-2026-34732 Medium 5.3 AVideo: Missing Authentication in CreatePlugin list.json.php Template Affects 21 Endpoints 0.4%
• CVE-2026-34731 High 7.5 AVideo: Unauthenticated Live Stream Termination via RTMP Callback on_publish_done.php 0.5%
• CVE-2026-34716 Medium 6.4 AVideo: DOM XSS via Unsanitized Display Name in WebSocket Call Notification 0.3%
• CVE-2026-34613 Medium 6.5 AVideo: CSRF on Plugin Enable/Disable Endpoint Allows Disabling Security Plugins 0.2%
• CVE-2026-34611 Medium 6.5 AVideo: CSRF on emailAllUsers.json.php Enables Mass Phishing Email to All Users 0.2%
• CVE-2026-34396 Medium 6.1 AVideo: Stored XSS via Unescaped Plugin Configuration Values in Admin Panel 0.2%
• CVE-2026-34394 High 8.1 AVideo: CSRF on Admin Plugin Configuration Enables Payment Credential Hijacking 0.2%
• CVE-2026-34395 Medium 6.5 AVideo: Mass User PII Disclosure via Missing Authorization in YPTWallet users.json.php 0.3%
• CVE-2026-34375 High 8.2 AVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment Page 0.3%
• CVE-2026-34374 Critical 9.1 AVideo has SQL Injection in Live_schedule::keyExists() via Unparameterized Stream Key 0.4%
• CVE-2026-34369 Medium 5.3 AVIdeo has Video Password Protection Bypass via API Endpoints Returning Full Playback Sources Without Password Verification 0.4%
• CVE-2026-34368 Medium 5.3 AVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalance 0.2%
• CVE-2026-34364 Medium 5.3 AVideo has User Group-Based Category Access Control Bypass via Missing and Broken Group Filtering in categories.json.php 0.3%
• CVE-2026-34362 Medium 5.4 AVideo's WebSocket Token Never Expires Due to Commented-Out Timeout Validation in verifyTokenSocket() 0.3%
• CVE-2026-34247 Medium 5.4 AVideo's IDOR in uploadPoster.php Allows Any Authenticated User to Overwrite Scheduled Live Stream Posters and Trigger False Socket Notifications 0.2%
• CVE-2026-34245 Medium 6.3 AVideo's Missing Authorization in Playlist Schedule Creation Allows Cross-User Broadcast Hijacking 0.3%
• CVE-2026-33867 Critical 9.1 AVideo has Plaintext Video Password Storage 0.2%
• CVE-2026-33770 High 7.1 AVideo has SQL Injection in category.php fixCleanTitle() via Unparameterized clean_title and id Variables 0.5%
• CVE-2026-33767 High 7.1 AVideo has SQL Injection via Partial Prepared Statement — videos_id Concatenated Directly into Query 0.5%
• CVE-2026-33766 Medium 5.3 AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints 0.2%
• CVE-2026-33764 Medium 4.3 AVideo: IDOR in AI Plugin Allows Stealing Other Users' AI-Generated Metadata and Transcriptions 0.2%
• CVE-2026-33763 Medium 5.3 AVideo has an Unauthenticated Video Password Brute-Force Vulnerability via Unrate-Limited Boolean Oracle 0.3%
• CVE-2026-33761 Medium 5.3 AVideo: Unauthenticated Access to Scheduler Plugin Endpoints Leaks Scheduled Tasks, Email Content, and User Mappings 0.4%
• CVE-2026-33759 Medium 5.3 AVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist Contents 0.3%
• CVE-2026-33723 High 7.1 AVideo Vulnerable to SQL Injection in Subscribe Endpoint via Unsanitized user_id Parameter in subscribe.php 0.2%
• CVE-2026-33719 High 8.6 AVideo Vulnerable to Unauthenticated CDN Configuration Takeover via Empty Default Key Bypass and Mass-Assignment in status.json.php 0.4%
• CVE-2026-33717 High 8.8 AVideo Vulnerable to Remote Code Execution via Persistent PHP Temp File in Encoder downloadURL with Resolution Validation Abort 0.4%
• CVE-2026-33716 Critical 9.4 AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php 0.4%
• CVE-2026-33690 Medium 5.3 AVideo vulnerable to IP Address Spoofing via Untrusted HTTP Headers in getRealIpAddr() 0.2%
• CVE-2026-33688 Medium 5.3 AVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery Endpoint 0.3%
• CVE-2026-33685 Medium 5.3 AVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User Data 0.3%
• CVE-2026-33683 Medium 5.4 AVideo vulnerable to Stored XSS via html_entity_decode() Reversing xss_esc() Sanitization in Channel About Field 0.2%
• CVE-2026-33681 High 7.2 AVideo has Path Traversal in pluginRunDatabaseScript.json.php Enables Arbitrary SQL File Execution via Unsanitized Plugin Name 0.5%
• CVE-2026-33651 High 8.1 AVideo has a Blind SQL Injection in Live Schedule Reminder via Unsanitized live_schedule_id in Scheduler_commands::getAllActiveOrToRepeat() 0.4%
• CVE-2026-33650 High 7.6 AVideo's Video Moderator Privilege Escalation via Ownership Transfer Enables Arbitrary Video Deletion 0.2%
• CVE-2026-33649 High 8.1 AVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission Modification 0.2%
• CVE-2026-33648 High 8.8 AVideo Vulnerable to OS Command Injection via Unsanitized `users_id` and `liveTransmitionHistory_id` in Restreamer Log File Path 0.6%
• CVE-2026-33647 High 8.8 AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload 0.7%
• CVE-2026-33513 High 8.6 AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP) 0.8%
• CVE-2026-33512 High 7.5 AVideo has an unauthenticated decrypt oracle leaking any ciphertext 0.2%
• CVE-2026-33507 High 8.8 AVideo Affected by CSRF on Plugin Import Endpoint Enables Unauthenticated Remote Code Execution via Malicious Plugin Upload 0.4%
• CVE-2026-33502 Critical 9.3 AVideo has Unauthenticated SSRF via plugin/Live/test.php 0.4%
• CVE-2026-33501 Medium 5.3 AVideo has Unauthenticated Information Disclosure of User Group Permission Mappings via Permissions Plugin 0.4%
• CVE-2026-33500 Medium 5.4 AVideo Vulnerable to Stored XSS via Markdown `javascript:` URI Bypasses ParsedownSafeWithLinks Sanitization 0.2%
• CVE-2026-33499 Medium 6.1 AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php 0.2%
• CVE-2026-33493 High 7.1 AVideo has a Path Traversal in import.json.php that Allows Private Video Theft and Arbitrary File Read/Deletion via fileURI Parameter 0.3%
• CVE-2026-33492 High 7.3 AVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session Regeneration 0.3%