AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset Deletion

WWBN AVideo has Stored XSS via Malicious EPG XML Program Titles in AVideo EPG Page

AVideo's WebSocket Token Never Expires Due to Commented-Out Timeout Validation in verifyTokenSocket()

AVideo's IDOR in uploadPoster.php Allows Any Authenticated User to Overwrite Scheduled Live Stream Posters and Trigger False Socket Notifications

AVideo vulnerable to Stored XSS via html_entity_decode() Reversing xss_esc() Sanitization in Channel About Field

AVideo Vulnerable to Stored XSS via Markdown `javascript:` URI Bypasses ParsedownSafeWithLinks Sanitization

AVideo Vulnerable to Stored XSS via Unescaped Video Title in CDN downloadButtons.php

WWBN AVideo 12.4 is vulnerable to Cross Site Scripting (XSS)

A cross-site scripting (xss) vulnerability exists in the navbarMenuAndLogo.php user name functionality of WWBN AVideo dev master commit 15fed957fb

A cross-site scripting (xss) vulnerability exists in the channelBody.php user name functionality of WWBN AVideo 11.6 and dev master commit 15fed957fb

WWBN/AVideo stored XSS vulnerability leads to takeover of any user's account, including admin's account

WWBN AVideo Missing Authorization via video_from_program API

WWBN AVideo Missing Authorization via mediaSession.json.php

WWBN AVideo Missing Authorization via videosAndroid.json.php Endpoint

WWBN AVideo Missing Authorization in ImageGallery list.json.php

WWBN AVideo Missing Authorization via getBookmarks.json.php

WWBN AVideo Missing Authentication via socketMessageLiveOwner.json.php

WWBN AVideo Unauthenticated Information Disclosure via menus.json.php

WWBN AVideo Missing Authentication via menuItems.json.php

WWBN AVideo Missing Authorization via playlistsFromUser.json.php

WWBN AVideo Missing Authorization via adsInfo API Endpoint

AVideo WebRTC Plugin Information Disclosure via status.json.php

WWBN AVideo Broken Access Control via feed/index.php program_id

WWBN AVideo Broken Access Control via Channel Page

WWBN AVideo Unauthenticated Password Hash Oracle via encryptPass.json.php

AVideo feed/index.php Exposure of Channel Owner Email Address

AVideo's Privilege AVideo: Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet Permissions

AVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumeration

WWBN AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php`

WWBN AVideo: Unauthenticated User Enumeration in `objects/users.json.php` via `isCompany` Parameter Flips `$ignoreAdmin = true` and Defeats Admin-Only Listing Guard

WWBN AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Allows Phishing from Site's Legitimate From Address

AVideo has an incomplete fix for CVE-2026-33039 (SSRF)

WWBN/AVideo has CAPTCHA Bypass via Attacker-Controlled Length Parameter and Missing Token Invalidation on Failure

WWBN AVideo has an Unauthenticated Information Disclosure via git.json.php that Exposes Developer Emails and Deployed Version

WWBN AVideo has Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php

WWBN AVideo has Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php

WWBN AVideo has Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.php

WWBN AVideo Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php

AVIdeo has Video Password Protection Bypass via API Endpoints Returning Full Playback Sources Without Password Verification

AVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalance

AVideo has User Group-Based Category Access Control Bypass via Missing and Broken Group Filtering in categories.json.php

AVideo has an Unauthenticated Video Password Brute-Force Vulnerability via Unrate-Limited Boolean Oracle

AVideo: Unauthenticated Access to Scheduler Plugin Endpoints Leaks Scheduled Tasks, Email Content, and User Mappings

AVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist Contents

AVideo vulnerable to IP Address Spoofing via Untrusted HTTP Headers in getRealIpAddr()

AVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery Endpoint

AVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User Data

AVideo has Unauthenticated Information Disclosure of User Group Permission Mappings via Permissions Plugin

AVideo has an Unauthenticated Password Hash Oracle via encryptPass.json.php

WWBN AVideo - Unauthenticated IDOR - Playlist Information Disclosure