AVideo through 29.0 Broken Access Control via CSRF Exemption Basename Collision

WWBN AVideo Missing Authorization via remindMe.json.php

AVideo through 29.0 Cross-User Category Asset Deletion via Missing Ownership Check

WWBN AVideo CSV Formula Injection via myComments.download.php

AVideo Open Redirect via playlistSort.php Referer Header

WWBN AVideo CustomizeUser Cross-Site Request Forgery Session Hijacking

AVideo userLogin.php Reflected XSS via error parameter

AVideo Reflected XSS via cancelUri in userLogin.php

AVideo Reflected XSS via videoEmbeded.php link parameter

AVideo Stored XSS via Live Schedule Title Description

AVideo channelToGallery.json.php Cross-Site Request Forgery

WWBN AVideo Live: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute

WWBN AVideo: Stored XSS via unescaped Gallery category description

WWBN AVideo: Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT_FOLLOWLOCATION Redirect Bypass

WWBN AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Any Logged-in User's Profile Photo with Arbitrary Bytes

WWBN AVideo has incomplete fix for CVE-2026-33500 (XSS)

WWBN AVideo Vulnerable to stored XSS via Unanchored Duration Regex in Video Encoder Receiver

WWBN AVideo's missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creators

AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset Deletion

WWBN AVideo has Stored XSS via Malicious EPG XML Program Titles in AVideo EPG Page

AVideo's WebSocket Token Never Expires Due to Commented-Out Timeout Validation in verifyTokenSocket()

AVideo's IDOR in uploadPoster.php Allows Any Authenticated User to Overwrite Scheduled Live Stream Posters and Trigger False Socket Notifications

AVideo vulnerable to Stored XSS via html_entity_decode() Reversing xss_esc() Sanitization in Channel About Field

AVideo Vulnerable to Stored XSS via Markdown `javascript:` URI Bypasses ParsedownSafeWithLinks Sanitization

AVideo Vulnerable to Stored XSS via Unescaped Video Title in CDN downloadButtons.php

WWBN AVideo 12.4 is vulnerable to Cross Site Scripting (XSS)

A cross-site scripting (xss) vulnerability exists in the navbarMenuAndLogo.php user name functionality of WWBN AVideo dev master commit 15fed957fb

A cross-site scripting (xss) vulnerability exists in the channelBody.php user name functionality of WWBN AVideo 11.6 and dev master commit 15fed957fb

WWBN AVideo is an open source video platform

WWBN AVideo Missing Authorization via video_from_program API

WWBN AVideo Missing Authorization via mediaSession.json.php

WWBN AVideo Missing Authorization via videosAndroid.json.php Endpoint

WWBN AVideo Missing Authorization in ImageGallery list.json.php

WWBN AVideo Missing Authorization via getBookmarks.json.php

WWBN AVideo Missing Authentication via socketMessageLiveOwner.json.php

WWBN AVideo Unauthenticated Information Disclosure via menus.json.php

WWBN AVideo Missing Authentication via menuItems.json.php

WWBN AVideo Missing Authorization via playlistsFromUser.json.php

WWBN AVideo Missing Authorization via adsInfo API Endpoint

AVideo WebRTC Plugin Information Disclosure via status.json.php

WWBN AVideo Broken Access Control via feed/index.php program_id

WWBN AVideo Broken Access Control via Channel Page

WWBN AVideo Unauthenticated Password Hash Oracle via encryptPass.json.php

AVideo feed/index.php Exposure of Channel Owner Email Address

AVideo's Privilege AVideo: Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet Permissions

AVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumeration

WWBN AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php`

WWBN AVideo: Unauthenticated User Enumeration in `objects/users.json.php` via `isCompany` Parameter Flips `$ignoreAdmin = true` and Defeats Admin-Only Listing Guard

WWBN AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Allows Phishing from Site's Legitimate From Address

AVideo has an incomplete fix for CVE-2026-33039 (SSRF)