Login Request a demo
AV
Product
AVideo
by WWBN · last CVE Oct 26, 2026
348
CVEs
0
On KEV
10.0
Max CVSS
7
New 30D
Vulnerabilities348In the news0Timeline
Severity mix
Critical 33High 135Medium 178Low 2
Severity
All severities348Critical33High135Medium178Low2
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add AVideo to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-33354
6.5
0%
Mar 23
AVideo has an authenticated arbitrary local file read via `chunkFile` path injection in `aVideoEncoder.json.php`
Affected: <= 26.0
CVE-2025-34435
6.5
0%
Dec 17
AVideo < 20.1 IDOR Arbitrary File Deletion
Affected: before 20.0
CVE-2023-49864
6.5
1%
Jan 10
An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb
Affected: dev_master_commit_15fed957fb
CVE-2023-49863
6.5
1%
Jan 10
An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb
Affected: All versions, or not specified
CVE-2023-49862
6.5
1%
Jan 10
An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb
Affected: All versions, or not specified
CVE-2023-49810
6.5
1%
Jan 10
A login attempt restriction bypass vulnerability exists in the checkLoginAttempts functionality of WWBN AVideo dev master commit 15fed957fb
Affected: 15fed957fb
CVE-2023-47171
6.5
1%
Jan 10
An information disclosure vulnerability exists in the aVideoEncoder.json.php chunkFile path functionality of WWBN AVideo 11.6 and dev master commit 15fed957fb
Affected: 11.6; 15fed957fb
CVE-2022-32761
6.5
3%
Aug 22
An information disclosure vulnerability exists in the aVideoEncoderReceiveImage functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364
Affected: 11.6
CVE-2022-28710
6.5
3%
Aug 22
An information disclosure vulnerability exists in the chunkFile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364
Affected: 11.6
CVE-2026-64626
6.4
0%
Jul 20
AVideo Encoder downloadURL SSRF via unpinned retry fallback
Affected: 0dbadbcaaa1b415c7db078a72dc4b26d9fac0485
CVE-2026-43876
6.4
0%
May 11
WWBN AVideo: HTML Injection in notifySubscribers.json.php Enables Platform-Branded Phishing Emails to Channel Subscribers
Affected: <= 29.0
CVE-2026-34716
6.4
0%
Mar 31
AVideo: DOM XSS via Unsanitized Display Name in WebSocket Call Notification
Affected: <= 26.0
CVE-2026-34245
6.3
0%
Mar 27
AVideo's Missing Authorization in Playlist Schedule Creation Allows Cross-User Broadcast Hijacking
Affected: <= 26.0
CVE-2026-116800
New
6.2
1%
Oct 26
WWBN AVideo before 29.5.0 Local PHP File Inclusion via Accept-Language Header
Affected: before 29.5.0
CVE-2026-92584
6.1
0%
Sep 16
AVideo through 29.0 Stored Cross-Site Scripting via User-Agent Header
Affected: through 29.0
CVE-2026-89247
6.1
0%
Sep 11
WWBN AVideo XML Injection via plugin/AD_Server/VMAP.php
Affected: through c3edcc274c389816d434acadac07ee78eaf330c1
CVE-2026-89244
6.1
0%
Sep 11
WWBN AVideo Reflected XSS via Gallery Category getBackURL
Affected: through c3edcc274c389816d434acadac07ee78eaf330c1
CVE-2026-89241
6.1
0%
Sep 11
WWBN AVideo Reflected XSS via confirmLivePassword.php
Affected: through c3edcc274c389816d434acadac07ee78eaf330c1
CVE-2026-89240
6.1
0%
Sep 11
WWBN AVideo Reflected XSS via confirmLivePassword.php
Affected: through c3edcc274c389816d434acadac07ee78eaf330c1
CVE-2026-89239
6.1
0%
Sep 11
WWBN AVideo Reflected XSS via Referer Header Comment Breakout
Affected: through c3edcc274c389816d434acadac07ee78eaf330c1
CVE-2026-82647
6.1
0%
Aug 30
WWBN AVideo Cross-Site Request Forgery via sendEmail.json.php
Affected: All versions, or not specified
CVE-2026-82646
6.1
0%
Aug 30
WWBN AVideo Unauthenticated Reflected XSS via url2Embed.json.php
Affected: All versions, or not specified
CVE-2026-50182
6.1
0%
Jul 15
AVideo Has Unauthenticated Reflected XSS via $_GET['search'] in YouTubeAPI Gallery Pagination
Affected: <= 29.0
CVE-2026-56347
6.1
0%
Jun 20
AVideo TopMenu Plugin - Stored Cross-Site Scripting via Unescaped Menu Item Fields
Affected: through 26.0
CVE-2026-43878
6.1
0%
May 11
WWBN AVideo: Reflected XSS in plugin/Meet/iframe.php via Unescaped `user`/`pass` Parameters Reflected into JavaScript String Literal
Affected: <= 29.0
CVE-2026-34739
6.1
0%
Mar 31
AVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.php
Affected: <= 26.0
CVE-2026-34396
6.1
0%
Mar 31
AVideo: Stored XSS via Unescaped Plugin Configuration Values in Admin Panel
Affected: <= 26.0
CVE-2026-33499
6.1
0%
Mar 23
AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php
Affected: <= 26.0
CVE-2026-33296
6.1
0%
Mar 22
AVideo has an Open Redirect via Unvalidated redirectUri in userLogin.php
Affected: < 26.0
CVE-2026-33035
6.1
0%
Mar 20
Unauthenticated Reflected XSS via innerHTML in AVideo
Affected: < 26.0
CVE-2026-27568
6.1
0%
Feb 24
AVideo has Stored Cross-Site Scripting via Markdown Comment Injection
Affected: < 21.0
CVE-2025-34439
6.1
0%
Dec 17
AVideo < 20.1 Open Redirect via cancelUri Parameter
Affected: before 20.0
CVE-2025-34440
6.1
0%
Dec 17
AVideo < 20.1 Open Redirect via siteRedirectUri Parameter
Affected: before 20.0
CVE-2025-46410
6.1
1%
Jul 24
A cross-site scripting (xss) vulnerability exists in the managerPlaylists PlaylistOwnerUsersId parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff
Affected: 14.4; dev master commit 8a8954ff
CVE-2025-53084
6.1
1%
Jul 24
A cross-site scripting (xss) vulnerability exists in the videosList page parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff
Affected: 14.4; dev master commit 8a8954ff
CVE-2025-50128
6.1
1%
Jul 24
A cross-site scripting (xss) vulnerability exists in the videoNotFound 404ErrorMsg parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff
Affected: 14.4; dev master commit 8a8954ff
CVE-2023-48728
6.1
2%
Jan 10
A cross-site scripting (xss) vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.6 and dev master commit 3c6bb3ff
Affected: 3c6bb3ff; 11.6
CVE-2023-25314
6.1
0%
Apr 25
Cross Site Scripting (XSS) vulnerability in World Wide Broadcast Network AVideo before 12.4, allows attackers to gain sensitive information via the success parameter to /user
Affected: before 12.4
CVE-2022-32772
6.1
4%
Aug 22
A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364
Affected: 11.6
CVE-2022-32771
6.1
5%
Aug 22
A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364
Affected: 11.6
CVE-2022-32770
6.1
5%
Aug 22
A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364
Affected: 11.6
CVE-2022-30690
6.1
84%
Aug 22
A cross-site scripting (xss) vulnerability exists in the image403 functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364
Affected: 11.6
CVE-2022-27463
6.1
1%
Apr 5
Open redirect vulnerability in objects/login.json.php in WWBN AVideo through 11.6, allows attackers to arbitrarily redirect users from a crafted url to the login page
Affected: through 11.6
CVE-2022-27462
6.1
1%
Apr 5
Cross Site Scripting (XSS) vulnerability in objects/function.php in function getDeviceID in WWBN AVideo through 11.6, via the yptDevice parameter to view/include/head.php
Affected: through 11.6
CVE-2026-86187
5.9
0%
Sep 5
WWBN AVideo Weak PRNG Password Generation via External Login
Affected: through 29.0
CVE-2026-91966
5.8
0%
Sep 15
AVideo through 29.0 Unauthenticated SSRF via Host Header
Affected: through 29.0
CVE-2026-58001
5.7
0%
Aug 22
WWBN AVideo Cross-Site Request Forgery via videoEditLight.php
Affected: through 9c39d8c8b4c1f75540788d6b391740852ceb0732
CVE-2026-33237
5.5
0%
Mar 20
AVideo has SSRF in Scheduler Plugin via callbackURL Missing `isSSRFSafeURL()` Validation
Affected: < 26.0
CVE-2026-116139
New
5.4
0%
Oct 25
WWBN AVideo 26.0 through 29.3.0 Stored XSS via Comment Markdown Rendering
Affected: 26.0 through 29.3.0
CVE-2026-100630
5.4
0%
Sep 26
AVideo before 29.1.0 Stored XSS via HTML Entity Bypass in trailer1 Field
Affected: before 29.1.0
Page 5 of 7 · 348 total
1…4567