AVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session Regeneration

WWBN AVideo Unauthenticated SSRF via login.json.php

AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting

AVideo Stored Cross-Site Scripting via Unauthenticated Registration

WWBN AVideo: Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']` Relay Bypass

AVideo has Path Traversal in pluginRunDatabaseScript.json.php Enables Arbitrary SQL File Execution via Unsanitized Plugin Name

AVideo through 29.0 Broken Access Control via videoAddNew.json.php CSRF Bypass

WWBN AVideo Cross-Site Request Forgery via logArchive.json.php

AVideo CustomizeUser setPassword.json.php CSRF

WWBN AVideo LoginControl PGP Key CSRF via GET Request

AVideo SocialMediaPublisher Missing Authorization via add.json.php

WWBN AVideo Cross-Site Request Forgery via deleteHistory.json.php

WWBN AVideo Server-Side Request Forgery via set_api_userImages

WWBN AVideo SSRF Filter Bypass via NAT64 Hex Address

WWBN AVideo Cross-Site Request Forgery via releaseVideoNow.json.php

AVideo has CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) that Exposes Authenticated API Responses

WWBN AVideo Vulnerable to CSRF in Admin JSON Endpoints (Category CRUD, Plugin Update Script)

WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration (Incomplete fix for CVE-2026-27732)

WWBN AVideo through 30.0 Information Disclosure via MobileManager

WWBN AVideo through 30.0 Information Disclosure via report4.json.php

WWBN AVideo: Password Hash Leaked in MobileManager OAuth Redirect URL Enables Account Takeover

WWBN AVideo before 29.4.0 Incorrect Authorization via confirmDeleteUser.json.php

AVideo Cryptographically Weak PRNG via uniqid Stream Key

AVideo through 29.0 Rate Limit Bypass via Non-Atomic Counter Increment

AVideo Missing Authorization in addLiveLink.php LiveLink Update

AVideo Missing Authorization via AD_Server log.php Wallet Credit

WWBN AVideo Cross-Site Request Forgery via playlistRemove.php

AVideo through 29.0 Information Disclosure via restreamsActive.json.php

AVideo YPTWallet saveBalance.php Cross-Site Request Forgery

AVideo API Rate Limit Bypass via Bot User-Agent Header

AVideo Server-Side Request Forgery via epg_link parameter

AVideo through c91b5975d CSRF via saveLive.php

WWBN AVideo Unauthenticated Rate Limit Bypass via preauthorize.json.php

WWBN AVideo Authorization Bypass via Users_affiliations add.json.php

AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data

WWBN AVideo plugin/LoginControl/set.json.php: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA

AVideo CVE-2026-43884 incomplete fix - `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD post

WWBN/AVideo has an incomplete fix for a directory traversal bypass via query string in ReceiveImage downloadURL parameters

AVideo's SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL

WWBN AVideo has a Path Traversal in Locale Save Endpoint that Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE)

WWBN AVideo has IDOR in Live Restreams list.json.php that Exposes Other Users' Stream Keys and OAuth Tokens

WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services

WWBN AVideo Affected by a PayPal IPN Replay Attack Enabling Wallet Balance Inflation via Missing Transaction Deduplication in ipn.php

AVideo: Stored SSRF via Video EPG Link Missing isSSRFSafeURL() Validation

AVideo: Arbitrary Stripe Subscription Cancellation via Debug Endpoint and retrieveSubscriptions() Bug

AVideo: CSRF on Plugin Enable/Disable Endpoint Allows Disabling Security Plugins

AVideo: CSRF on emailAllUsers.json.php Enables Mass Phishing Email to All Users

AVideo: Mass User PII Disclosure via Missing Authorization in YPTWallet users.json.php

AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints

AVideo Vulnerable to SQL Injection in Subscribe Endpoint via Unsanitized user_id Parameter in subscribe.php