WWBN AVideo Reflected XSS via confirmLivePassword.php

WWBN AVideo Reflected XSS via Referer Header Comment Breakout

WWBN AVideo Cross-Site Request Forgery via sendEmail.json.php

WWBN AVideo Unauthenticated Reflected XSS via url2Embed.json.php

AVideo Has Unauthenticated Reflected XSS via $_GET['search'] in YouTubeAPI Gallery Pagination

AVideo TopMenu Plugin - Stored Cross-Site Scripting via Unescaped Menu Item Fields

WWBN AVideo: Reflected XSS in plugin/Meet/iframe.php via Unescaped `user`/`pass` Parameters Reflected into JavaScript String Literal

AVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.php

AVideo: Stored XSS via Unescaped Plugin Configuration Values in Admin Panel

AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php

AVideo has an Open Redirect via Unvalidated redirectUri in userLogin.php

Unauthenticated Reflected XSS via innerHTML in AVideo

AVideo has Stored Cross-Site Scripting via Markdown Comment Injection

AVideo < 20.1 Open Redirect via cancelUri Parameter

AVideo < 20.1 Open Redirect via siteRedirectUri Parameter

A cross-site scripting (xss) vulnerability exists in the managerPlaylists PlaylistOwnerUsersId parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff

A cross-site scripting (xss) vulnerability exists in the videosList page parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff

A cross-site scripting (xss) vulnerability exists in the videoNotFound 404ErrorMsg parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff

A cross-site scripting (xss) vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.6 and dev master commit 3c6bb3ff

Cross Site Scripting (XSS) vulnerability in World Wide Broadcast Network AVideo before 12.4, allows attackers to gain sensitive information via the success parameter to /user

A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364

A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364

A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364

A cross-site scripting (xss) vulnerability exists in the image403 functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364

Open redirect vulnerability in objects/login.json.php in WWBN AVideo through 11.6, allows attackers to arbitrarily redirect users from a crafted url to the login page

Cross Site Scripting (XSS) vulnerability in objects/function.php in function getDeviceID in WWBN AVideo through 11.6, via the yptDevice parameter to view/include/head.php

WWBN AVideo Weak PRNG Password Generation via External Login

AVideo through 29.0 Unauthenticated SSRF via Host Header

WWBN AVideo Cross-Site Request Forgery via videoEditLight.php

AVideo has SSRF in Scheduler Plugin via callbackURL Missing `isSSRFSafeURL()` Validation

WWBN AVideo 26.0 through 29.3.0 Stored XSS via Comment Markdown Rendering

AVideo before 29.1.0 Stored XSS via HTML Entity Bypass in trailer1 Field

AVideo through 29.0 Broken Access Control via CSRF Exemption Basename Collision

WWBN AVideo Missing Authorization via remindMe.json.php

AVideo through 29.0 Cross-User Category Asset Deletion via Missing Ownership Check

WWBN AVideo CSV Formula Injection via myComments.download.php

AVideo Open Redirect via playlistSort.php Referer Header

WWBN AVideo CustomizeUser Cross-Site Request Forgery Session Hijacking

AVideo userLogin.php Reflected XSS via error parameter

AVideo Reflected XSS via cancelUri in userLogin.php

AVideo Reflected XSS via videoEmbeded.php link parameter

AVideo Stored XSS via Live Schedule Title Description

AVideo channelToGallery.json.php Cross-Site Request Forgery

WWBN AVideo Live: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute

WWBN AVideo: Stored XSS via unescaped Gallery category description

WWBN AVideo: Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT_FOLLOWLOCATION Redirect Bypass

WWBN AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Any Logged-in User's Profile Photo with Arbitrary Bytes

WWBN AVideo has incomplete fix for CVE-2026-33500 (XSS)

WWBN AVideo Vulnerable to stored XSS via Unanchored Duration Regex in Video Encoder Receiver

WWBN AVideo's missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creators