AVideo LoginControl PGP Second Factor Authentication Bypass

WWBN AVideo through 29.0 Authentication Bypass via Stored Password Hash

WWBN AVideo Stored XSS via UserGroups setGroup_name

AVideo Missing Authorization via getRestream.json.php

AVideo LoginControl PGP Authentication Bypass via verifyChallenge

AVideo Authentication Bypass via SQL Cache Invalidation

WWBN AVideo Missing Authorization via resendRestreamer.json.php

AVideo through c91b5975d CSRF and Path Traversal via stopLive.php

AVideo Cross-Site Request Forgery via plugin/API/set.json.php

AVideo incomplete fix for CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command execution at the same execAsync sh -c sink

AVideo through 29.0 OS Command Injection via ffmpeg.json.php

AVideo through 29.0 OS Command Injection via listFFmpegProcesses

AVideo has an incomplete fix for CVE-2026-33293 (Path Traversal) in AVideo

AVideos has CORS Origin Reflection with Credentials on Sensitive API Endpoints that Enables Cross-Origin Account Takeover

AVideo: CSRF on Admin Plugin Configuration Enables Payment Credential Hijacking

AVideo has a Path Traversal in import.json.php that Allows Private Video Theft and Arbitrary File Read/Deletion via fileURI Parameter

AVideo has a PGP 2FA Bypass via Cryptographically Broken 512-bit RSA Key Generation in LoginControl Plugin

AVideo has an OS Command Injection via $() Shell Substitution Bypass in sanitizeFFmpegCommand()

AVideo Affected by Arbitrary File Deletion via Path Traversal in CloneSite deleteDump Parameter

AVideo affected by Session Hijacking via Unauthenticated Session ID Disclosure with Permissive CORS

AVideo affected by unauthenticated application takeover via exposed web installer on uninitialized deployments

WWBN AVideo has predictable default admin credentials in official Docker deployment path

AVideo has Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.php

AVideo < 20.1 IDOR Arbitrary Video Rotation

WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass)

WWBN AVideo: Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization

WWBN AVideo: SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL()

WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLs

AVideo's Video Moderator Privilege Escalation via Ownership Transfer Enables Arbitrary Video Deletion

AVideo through 29.0 API get_api_video Broken Access Control via clean_title

WWBN AVideo through 29.0 Broken Access Control via Live Endpoints

WWBN AVideo Unauthenticated File Read via getRecordedFile.php

AVideo PlayerSkins seo.php Missing Authorization Password-Protected VOD

AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 Authentication Bypass

AVideo through 29.0 Unauthenticated Disclosure via epg.json.php

AVideo through 29.0 Information Disclosure via stats.json.php

AVideo through c3edcc274c Authorization Bypass via Session Cookie

WWBN AVideo SQL Injection via get.json.php APIName channels

WWBN AVideo Authentication Bypass via X-Real-IP Header

AVideo User_Location Plugin Unauthenticated SQL Injection

WWBN AVideo Brute-force Rate Limiting Bypass via Missing User-Agent

AVideo SSRF Guard Bypass via IPv6 Transition Addresses

WWBN AVideo Unbound Token Authorization Bypass via Gallery

AVideo Has Unauthenticated .env File Exposure via Official Docker Compose Configuration

WWBN AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone Server

AVideo: Missing Authentication in CreatePlugin list.json.php Template Affects 21 Endpoints

AVideo: Unauthenticated Live Stream Termination via RTMP Callback on_publish_done.php

AVideo has Plaintext Video Password Storage

AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP)

AVideo has an unauthenticated decrypt oracle leaking any ciphertext