AVideo has an Unauthenticated Blind SQL Injection in RTMP on_publish Callback via Stream Name Parameter

AVideo Affected by Unauthenticated Disk Space Exhaustion via Unlimited Temp File Creation in aVideoEncoderChunk.json.php

AVideo Vulnerable to OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command

AVideo has Authorization Bypass via Path Traversal in HLS Endpoint Allows Streaming Private/Paid Videos

AVideo Platform 8.1 - Information Disclosure (User Enumeration)

AVideo < 20.1 System Path Disclosure via Public API

AVideo < 20.1 User Information Disclosure via Public API

A race condition vulnerability exists in the aVideoEncoder.json.php unzip functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff

An information disclosure vulnerability exists in the image404Raw.php functionality of WWBN AVideo dev master commit 15fed957fb

An information disclosure vulnerability exists in the cookie functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364

An information disclosure vulnerability exists in the cookie functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364

There was a local file disclosure vulnerability in AVideo < 8.9 via the proxy streaming

AVideo Weak PRNG Activation Code Authentication Bypass

WWBN AVideo Unrestricted Authentication Attempts via get_api_preauthorize

WWBN AVideo userVerifyEmail.php Unauthenticated Access Control

WWBN AVideo Unauthenticated Arbitrary Log File Deletion

AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard

AVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session Regeneration

WWBN AVideo Unauthenticated SSRF via login.json.php

AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting

AVideo Stored Cross-Site Scripting via Unauthenticated Registration

WWBN AVideo: Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']` Relay Bypass

AVideo has Path Traversal in pluginRunDatabaseScript.json.php Enables Arbitrary SQL File Execution via Unsanitized Plugin Name

AVideo through 29.0 Broken Access Control via videoAddNew.json.php CSRF Bypass

WWBN AVideo Cross-Site Request Forgery via logArchive.json.php

AVideo CustomizeUser setPassword.json.php CSRF

WWBN AVideo LoginControl PGP Key CSRF via GET Request

AVideo SocialMediaPublisher Missing Authorization via add.json.php

WWBN AVideo Cross-Site Request Forgery via deleteHistory.json.php

WWBN AVideo Server-Side Request Forgery via set_api_userImages

WWBN AVideo SSRF Filter Bypass via NAT64 Hex Address

WWBN AVideo Cross-Site Request Forgery via releaseVideoNow.json.php

AVideo has CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) that Exposes Authenticated API Responses

WWBN AVideo Vulnerable to CSRF in Admin JSON Endpoints (Category CRUD, Plugin Update Script)

WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration (Incomplete fix for CVE-2026-27732)