WWBN AVideo through 30.0 Information Disclosure via MobileManager

WWBN AVideo through 30.0 Information Disclosure via report4.json.php

WWBN AVideo: Password Hash Leaked in MobileManager OAuth Redirect URL Enables Account Takeover

WWBN AVideo before 29.4.0 Incorrect Authorization via confirmDeleteUser.json.php

AVideo Cryptographically Weak PRNG via uniqid Stream Key

AVideo through 29.0 Rate Limit Bypass via Non-Atomic Counter Increment

AVideo Missing Authorization in addLiveLink.php LiveLink Update

AVideo Missing Authorization via AD_Server log.php Wallet Credit

WWBN AVideo Cross-Site Request Forgery via playlistRemove.php

AVideo through 29.0 Information Disclosure via restreamsActive.json.php

AVideo YPTWallet saveBalance.php Cross-Site Request Forgery

AVideo API Rate Limit Bypass via Bot User-Agent Header

AVideo Server-Side Request Forgery via epg_link parameter

AVideo through c91b5975d CSRF via saveLive.php

WWBN AVideo Unauthenticated Rate Limit Bypass via preauthorize.json.php

WWBN AVideo Authorization Bypass via Users_affiliations add.json.php

AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data

WWBN AVideo plugin/LoginControl/set.json.php: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA

AVideo CVE-2026-43884 incomplete fix - `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD post

WWBN/AVideo has an incomplete fix for a directory traversal bypass via query string in ReceiveImage downloadURL parameters

AVideo's SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL

WWBN AVideo has a Path Traversal in Locale Save Endpoint that Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE)

WWBN AVideo has IDOR in Live Restreams list.json.php that Exposes Other Users' Stream Keys and OAuth Tokens

WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services

WWBN AVideo Affected by a PayPal IPN Replay Attack Enabling Wallet Balance Inflation via Missing Transaction Deduplication in ipn.php

AVideo: Stored SSRF via Video EPG Link Missing isSSRFSafeURL() Validation

AVideo: Arbitrary Stripe Subscription Cancellation via Debug Endpoint and retrieveSubscriptions() Bug

AVideo: CSRF on Plugin Enable/Disable Endpoint Allows Disabling Security Plugins

AVideo: CSRF on emailAllUsers.json.php Enables Mass Phishing Email to All Users

AVideo: Mass User PII Disclosure via Missing Authorization in YPTWallet users.json.php

AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints

AVideo Vulnerable to SQL Injection in Subscribe Endpoint via Unsanitized user_id Parameter in subscribe.php

AVideo has an authenticated arbitrary local file read via `chunkFile` path injection in `aVideoEncoder.json.php`

AVideo < 20.1 IDOR Arbitrary File Deletion

An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb

An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb

An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb

A login attempt restriction bypass vulnerability exists in the checkLoginAttempts functionality of WWBN AVideo dev master commit 15fed957fb

An information disclosure vulnerability exists in the aVideoEncoder.json.php chunkFile path functionality of WWBN AVideo 11.6 and dev master commit 15fed957fb

An information disclosure vulnerability exists in the aVideoEncoderReceiveImage functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364

An information disclosure vulnerability exists in the chunkFile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364

AVideo Encoder downloadURL SSRF via unpinned retry fallback

WWBN AVideo: HTML Injection in notifySubscribers.json.php Enables Platform-Branded Phishing Emails to Channel Subscribers

AVideo: DOM XSS via Unsanitized Display Name in WebSocket Call Notification

AVideo's Missing Authorization in Playlist Schedule Creation Allows Cross-User Broadcast Hijacking

WWBN AVideo before 29.5.0 Local PHP File Inclusion via Accept-Language Header

AVideo through 29.0 Stored Cross-Site Scripting via User-Agent Header

WWBN AVideo XML Injection via plugin/AD_Server/VMAP.php

WWBN AVideo Reflected XSS via Gallery Category getBackURL

WWBN AVideo Reflected XSS via confirmLivePassword.php