CVE-2026-33488High 7.4AVideo has a PGP 2FA Bypass via Cryptographically Broken 512-bit RSA Key Generation in LoginControl Plugin0.3%
CVE-2026-33485High 7.5AVideo has an Unauthenticated Blind SQL Injection in RTMP on_publish Callback via Stream Name Parameter0.5%
CVE-2026-33483High 7.5AVideo Affected by Unauthenticated Disk Space Exhaustion via Unlimited Temp File Creation in aVideoEncoderChunk.json.php0.6%
CVE-2026-33482High 8.1AVideo has an OS Command Injection via $() Shell Substitution Bypass in sanitizeFFmpegCommand()4.3%
CVE-2026-33480High 8.6AVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks Proxy0.3%
CVE-2026-33479High 8.8AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin0.5%
CVE-2026-33478Critical 10.0AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection13.3%
CVE-2026-33354High 7.6AVideo has an authenticated arbitrary local file read via `chunkFile` path injection in `aVideoEncoder.json.php`0.3%
CVE-2026-33352Critical 9.8AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass)0.5%
CVE-2026-33351Critical 9.1AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass0.4%
CVE-2026-33297Medium 5.1AVideo has an IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.php0.4%
CVE-2026-33296Low 2.1AVideo has an Open Redirect via Unvalidated redirectUri in userLogin.php0.2%
CVE-2026-33295High 8.2AVideo Vulnerable to Stored XSS via Unescaped Video Title in CDN downloadButtons.php0.2%
CVE-2026-33294Medium 5.0AVideo has SSRF in BulkEmbed Thumbnail Fetch that Allows Reading Internal Network Resources0.3%
CVE-2026-33293High 8.1AVideo Affected by Arbitrary File Deletion via Path Traversal in CloneSite deleteDump Parameter0.5%
CVE-2026-33319Medium 5.9AVideo Vulnerable to OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command0.3%
CVE-2026-33292High 7.5AVideo has Authorization Bypass via Path Traversal in HLS Endpoint Allows Streaming Private/Paid Videos0.7%
CVE-2026-33238Medium 4.3AVideo has a Path Traversal in listFiles.json.php that Enables Server Filesystem Enumeration0.4%
CVE-2026-33237Medium 5.5AVideo has SSRF in Scheduler Plugin via callbackURL Missing `isSSRFSafeURL()` Validation0.4%
CVE-2026-33043High 8.1AVideo affected by Session Hijacking via Unauthenticated Session ID Disclosure with Permissive CORS0.4%
CVE-2026-33041Medium 5.3AVideo has an Unauthenticated Password Hash Oracle via encryptPass.json.php0.3%
CVE-2026-33039High 8.6AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy0.5%
CVE-2026-33038High 8.1AVideo affected by unauthenticated application takeover via exposed web installer on uninitialized deployments0.5%
CVE-2026-33037High 8.1WWBN AVideo has predictable default admin credentials in official Docker deployment path0.7%
CVE-2026-33035Medium 5.3Unauthenticated Reflected XSS via innerHTML in AVideo0.3%
CVE-2026-30885Medium 5.5WWBN AVideo - Unauthenticated IDOR - Playlist Information Disclosure0.4%
CVE-2026-28501Critical 9.8WWBN AVideo: Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php1.7%
CVE-2026-28502Critical 9.3WWBN AVideo: Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction0.8%
CVE-2026-29093High 8.1WWBN AVideo: Unauthenticated PHP session store exposed to host network via published memcached port0.5%
CVE-2026-27732High 8.6AVideo has Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.php0.3%
CVE-2026-27568Medium 5.1AVideo has Stored Cross-Site Scripting via Markdown Comment Injection0.3%
CVE-2025-46410Critical 9.6A cross-site scripting (xss) vulnerability exists in the managerPlaylists PlaylistOwnerUsersId parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A specially crafted HTTP requ1.0%
CVE-2025-53084Critical 9.0A cross-site scripting (xss) vulnerability exists in the videosList page parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A specially crafted HTTP request can lead to arbitr1.0%
CVE-2025-50128Critical 9.6A cross-site scripting (xss) vulnerability exists in the videoNotFound 404ErrorMsg parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A specially crafted HTTP request can lead1.0%
CVE-2025-36548High 8.3A cross-site scripting (xss) vulnerability exists in the LoginWordPress loginForm cancelUri parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A specially crafted HTTP request1.3%
CVE-2025-41420Critical 9.6A cross-site scripting (xss) vulnerability exists in the userLogin cancelUri parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A specially crafted HTTP request can lead to ar1.5%
CVE-2025-25214High 8.8A race condition vulnerability exists in the aVideoEncoder.json.php unzip functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A series of specially crafted HTTP request can lead to arbit1.2%
CVE-2025-48732High 7.3An incomplete blacklist exists in the .htaccess sample of WWBN AVideo 14.4 and dev master commit 8a8954ff. A specially crafted HTTP request can lead to a arbitrary code execution. An attacker can requ1.3%
CVE-2023-47171Medium 6.5An information disclosure vulnerability exists in the aVideoEncoder.json.php chunkFile path functionality of WWBN AVideo 11.6 and dev master commit 15fed957fb. A specially crafted HTTP request can lea1.1%
CVE-2023-49864Medium 6.5An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can le1.1%
CVE-2023-49863Medium 6.5An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can le1.1%
CVE-2023-49862Medium 6.5An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can le1.1%
CVE-2023-49738High 7.5An information disclosure vulnerability exists in the image404Raw.php functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary file read.1.3%
CVE-2023-48730High 8.5A cross-site scripting (xss) vulnerability exists in the navbarMenuAndLogo.php user name functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitra0.6%
CVE-2023-48728Critical 9.6A cross-site scripting (xss) vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.6 and dev master commit 3c6bb3ff. A specially crafted HTTP request can lead to a2.3%
CVE-2023-47861Critical 9.0A cross-site scripting (xss) vulnerability exists in the channelBody.php user name functionality of WWBN AVideo 11.6 and dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbi0.8%
CVE-2023-49715Medium 4.3A unrestricted php file upload vulnerability exists in the import.json.php temporary copy functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitr1.4%
CVE-2023-47862Critical 9.8A local file inclusion vulnerability exists in the getLanguageFromBrowser functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary code executi1.1%
CVE-2023-49589High 8.8An insufficient entropy vulnerability exists in the userRecoverPass.php recoverPass generation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to a0.9%
CVE-2023-50172Medium 5.3A recovery notification bypass vulnerability exists in the userRecoverPass.php captcha validation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead t0.8%