AV
Product
AVideo
348
CVEs
0
On KEV
10.0
Max CVSS
7
New 30D
Severity mix
Critical 33High 135Medium 178Low 2
Watch
Add AVideo to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-50172 | 5.3 | Jan 10 | A recovery notification bypass vulnerability exists in the userRecoverPass.php captcha validation functionality of WWBN AVideo dev master commit 15fed957fb Affected: 15fed957fb |
| CVE-2026-81733 | 5.1 | Aug 28 | WWBN AVideo through 30.0 CSRF via myLiveControls.save.json.php Affected: through 30.0 |
| CVE-2026-91967 | 5.0 | Sep 15 | AVideo through 29.0 Blind SSRF via getHeaderContentTypeFromURL Affected: through 29.0 |
| CVE-2022-32769 | 5.0 | Aug 22 | Multiple authentication bypass vulnerabilities exist in the objects id handling functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364 Affected: 11.6 |
| CVE-2026-45731 | 4.9 | May 29 | WWBN AVideo: Authenticated Arbitrary File Read in view/update.php Affected: <= 29.0 |
| CVE-2026-50183 | 4.7 | Jul 15 | WWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery Section Affected: <= 29.0 |
| CVE-2026-114634 | 4.3 | Oct 22 | WWBN AVideo before 29.4.0 Blind SSRF via getHeaderContentTypeFromURL Redirect Affected: before 29.4.0 |
| CVE-2026-92586 | 4.3 | Sep 16 | AVideo through 29.0 Missing Authorization via comment API endpoint Affected: through c3edcc274c389816d434acadac07ee78eaf330c1; through 29.0 |
| CVE-2026-92585 | 4.3 | Sep 16 | AVideo through 29.0 Missing Authorization Check via API Like Endpoint Affected: through c3edcc274c389816d434acadac07ee78eaf330c1; through 29.0 |
| CVE-2026-92581 | 4.3 | Sep 16 | AVideo through 29.0 Like Counter Desynchronization via Array Parameter Affected: through 29.0 |
| CVE-2026-90552 | 4.3 | Sep 12 | WWBN AVideo Missing Authorization via Playlists_schedules list.json.php Affected: through c3edcc274c389816d434acadac07ee78eaf330c1 |
| CVE-2026-90546 | 4.3 | Sep 12 | WWBN AVideo Missing Authorization via like.json.php Affected: through c3edcc274c389816d434acadac07ee78eaf330c1 |
| CVE-2026-90545 | 4.3 | Sep 12 | WWBN AVideo Missing Authorization via commentAddNew.json.php Affected: through c3edcc274c389816d434acadac07ee78eaf330c1 |
| CVE-2026-90544 | 4.3 | Sep 12 | WWBN AVideo Missing Authorization via videoAddViewCount.json.php Affected: through c3edcc274c389816d434acadac07ee78eaf330c1 |
| CVE-2026-90540 | 4.3 | Sep 12 | WWBN AVideo Missing Authorization via playListAddVideo.json.php Affected: through c3edcc274c389816d434acadac07ee78eaf330c1 |
| CVE-2026-88875 | 4.3 | Sep 10 | AVideo Incomplete API Sanitization Information Disclosure Affected: through c3edcc274c389816d434acadac07ee78eaf330c1 |
| CVE-2026-88871 | 4.3 | Sep 10 | WWBN AVideo CustomizeUser setSubscribers CSRF via GET Affected: through c3edcc274c389816d434acadac07ee78eaf330c1 |
| CVE-2026-85161 | 4.3 | Sep 3 | AVideo removePoster.php Cross-Site Request Forgery File Deletion Affected: through c91b5975d |
| CVE-2026-47696 | 4.3 | May 29 | WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint Affected: <= 29.0 |
| CVE-2026-43882 | 4.3 | May 11 | WWBN AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event Spoofing Affected: <= 29.0 |
| CVE-2026-35181 | 4.3 | Apr 6 | WWBN AVideo Affected by CSRF on Player Skin Configuration via admin/playerUpdate.json.php Affected: <= 26.0 |
| CVE-2026-35180 | 4.3 | Apr 6 | WWBN AVideo affected by CSRF on Site Customization Endpoint Enables Logo Overwrite via Base64 File Write Affected: <= 26.0 |
| CVE-2026-34738 | 4.3 | Mar 31 | AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter Affected: <= 26.0 |
| CVE-2026-33764 | 4.3 | Mar 27 | AVideo: IDOR in AI Plugin Allows Stealing Other Users' AI-Generated Metadata and Transcriptions Affected: <= 26.0 |
| CVE-2026-33294 | 4.3 | Mar 22 | AVideo has SSRF in BulkEmbed Thumbnail Fetch that Allows Reading Internal Network Resources Affected: < 26.0 |
| CVE-2026-33238 | 4.3 | Mar 20 | AVideo has a Path Traversal in listFiles.json.php that Enables Server Filesystem Enumeration Affected: < 26.0 |
| CVE-2026-43883 | 4.2 | May 11 | WWBN AVideo: IDOR in PayPalYPT agreementCancel.json.php Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription Agreements Affected: <= 29.0 |
| CVE-2022-32768 | 4.2 | Aug 22 | Multiple authentication bypass vulnerabilities exist in the objects id handling functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364 Affected: 11.6 |