WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks

AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection

A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364

WWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg.json.php

WWBN AVideo Authentication Bypass via Non-Expiring video_id_hash

WWBN AVideo Password Recovery Token Expiration Bypass

AVideo before 29.0 OS Command Injection via execAsync

WWBN AVideo vulnerable to RCE caused by clonesite plugin

AVideo has SQL Injection in category.php fixCleanTitle() via Unparameterized clean_title and id Variables

AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass)

WWBN AVideo: Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php

WWBN AVideo: Unauthenticated PHP session store exposed to host network via published memcached port

AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)

An incomplete blacklist exists in the .htaccess sample of WWBN AVideo 14.4 and dev master commit 8a8954ff

An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath parameter of the submitIndex.php component

An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed957fb

A local file inclusion vulnerability exists in the getLanguageFromBrowser functionality of WWBN AVideo dev master commit 15fed957fb

OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbitrary code via the video link field to the Embed a video…

AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin

A cross-site scripting (xss) vulnerability exists in the userLogin cancelUri parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff

A cross-site scripting (xss) vulnerability exists in the LoginWordPress loginForm cancelUri parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff

A reflected cross-site scripting (xss) vulnerability exists in the charts tab selection functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364

AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php

AVideo AD_Server Stored XSS via log.php label parameter

AVideo has an incomplete fix for CVE-2026-33502 (Command Injection)

WWBN AVideo Broken Access Control via videoViewsInfo hash Parameter

WWBN AVideo Authentication Bypass via User-Agent Header

AVideo Unauthenticated Arbitrary File Write via aVideoEncoderChunk.json.php

AVideo has SQL Injection in Live_schedule::keyExists() via Unparameterized Stream Key

AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass

AVideo has an IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.php

AVideo versions prior to 20.1 with the ImageGallery plugin enabled is vulnerable to unauthenticated file upload and deletion

A cross-site scripting (xss) vulnerability exists in the videoAddNew functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364

AVideo through 29.0 CloneSite Stored Shell Injection via SSH Password CSRF

WWBN AVideo Cross-Site Request Forgery via get_domain() validation

AVideo Authentication Bypass via Unkeyed Video Hash Disclosure

WWBN AVideo Live: OS command injection in on_publish.php execAsync via unescaped m3u8 URL

AVideo has SQL Injection via Partial Prepared Statement — videos_id Concatenated Directly into Query

AVideo Vulnerable to Remote Code Execution via Persistent PHP Temp File in Encoder downloadURL with Resolution Validation Abort

AVideo has a Blind SQL Injection in Live Schedule Reminder via Unsanitized live_schedule_id in Scheduler_commands::getAllActiveOrToRepeat()

AVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission Modification

AVideo Vulnerable to OS Command Injection via Unsanitized `users_id` and `liveTransmitionHistory_id` in Restreamer Log File Path

AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload

AVideo Affected by CSRF on Plugin Import Endpoint Enables Unauthenticated Remote Code Execution via Malicious Plugin Upload

AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin

WWBN AVideo: Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction

AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)

AVideo versions prior to 20.1 permit any authenticated user to upload comment images to videos owned by other users

AVideo versions prior to 20.1 allow any authenticated user to upload files into directories belonging to other users due to an insecure direct object reference

A unrestricted php file upload vulnerability exists in the import.json.php temporary copy functionality of WWBN AVideo dev master commit 15fed957fb