WWBN/AVideo has CAPTCHA Bypass via Attacker-Controlled Length Parameter and Missing Token Invalidation on Failure

WWBN AVideo has an Unauthenticated Information Disclosure via git.json.php that Exposes Developer Emails and Deployed Version

WWBN AVideo has Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php

WWBN AVideo has Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php

WWBN AVideo has Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.php

WWBN AVideo Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php

AVIdeo has Video Password Protection Bypass via API Endpoints Returning Full Playback Sources Without Password Verification

AVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalance

AVideo has User Group-Based Category Access Control Bypass via Missing and Broken Group Filtering in categories.json.php

AVideo has an Unauthenticated Video Password Brute-Force Vulnerability via Unrate-Limited Boolean Oracle

AVideo: Unauthenticated Access to Scheduler Plugin Endpoints Leaks Scheduled Tasks, Email Content, and User Mappings

AVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist Contents

AVideo vulnerable to IP Address Spoofing via Untrusted HTTP Headers in getRealIpAddr()

AVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery Endpoint

AVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User Data

AVideo has Unauthenticated Information Disclosure of User Group Permission Mappings via Permissions Plugin

AVideo has an Unauthenticated Password Hash Oracle via encryptPass.json.php

WWBN AVideo - Unauthenticated IDOR - Playlist Information Disclosure

A recovery notification bypass vulnerability exists in the userRecoverPass.php captcha validation functionality of WWBN AVideo dev master commit 15fed957fb

WWBN AVideo through 30.0 CSRF via myLiveControls.save.json.php

AVideo through 29.0 Blind SSRF via getHeaderContentTypeFromURL

Multiple authentication bypass vulnerabilities exist in the objects id handling functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364

WWBN AVideo: Authenticated Arbitrary File Read in view/update.php

WWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery Section

WWBN AVideo before 29.4.0 Blind SSRF via getHeaderContentTypeFromURL Redirect

AVideo through 29.0 Missing Authorization via comment API endpoint

AVideo through 29.0 Missing Authorization Check via API Like Endpoint

AVideo through 29.0 Like Counter Desynchronization via Array Parameter

WWBN AVideo Missing Authorization via Playlists_schedules list.json.php

WWBN AVideo Missing Authorization via like.json.php

WWBN AVideo Missing Authorization via commentAddNew.json.php

WWBN AVideo Missing Authorization via videoAddViewCount.json.php

WWBN AVideo Missing Authorization via playListAddVideo.json.php

AVideo Incomplete API Sanitization Information Disclosure

WWBN AVideo CustomizeUser setSubscribers CSRF via GET

AVideo removePoster.php Cross-Site Request Forgery File Deletion

WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint

WWBN AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event Spoofing

WWBN AVideo Affected by CSRF on Player Skin Configuration via admin/playerUpdate.json.php

WWBN AVideo affected by CSRF on Site Customization Endpoint Enables Logo Overwrite via Base64 File Write

AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter

AVideo: IDOR in AI Plugin Allows Stealing Other Users' AI-Generated Metadata and Transcriptions

AVideo has SSRF in BulkEmbed Thumbnail Fetch that Allows Reading Internal Network Resources

AVideo has a Path Traversal in listFiles.json.php that Enables Server Filesystem Enumeration

WWBN AVideo: IDOR in PayPalYPT agreementCancel.json.php Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription Agreements

Multiple authentication bypass vulnerabilities exist in the objects id handling functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364

WWBN AVideo Provides Unauthenticated Access to Payment Order Data via BlockonomicsYPT check.php

WWBN AVideo before 24.0 CSRF via Legacy Playlist and Video Endpoints