WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks

AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection

A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364

WWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg.json.php

WWBN AVideo Authentication Bypass via Non-Expiring video_id_hash

WWBN AVideo Password Recovery Token Expiration Bypass

AVideo before 29.0 OS Command Injection via execAsync

WWBN AVideo vulnerable to RCE caused by clonesite plugin

AVideo has SQL Injection in category.php fixCleanTitle() via Unparameterized clean_title and id Variables

AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass)

WWBN AVideo: Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php

WWBN AVideo: Unauthenticated PHP session store exposed to host network via published memcached port

AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)

An incomplete blacklist exists in the .htaccess sample of WWBN AVideo 14.4 and dev master commit 8a8954ff

An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath parameter of the submitIndex.php component

An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed957fb

A local file inclusion vulnerability exists in the getLanguageFromBrowser functionality of WWBN AVideo dev master commit 15fed957fb

OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbitrary code via the video link field to the Embed a video…

AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin

A cross-site scripting (xss) vulnerability exists in the LoginWordPress loginForm cancelUri parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff

A cross-site scripting (xss) vulnerability exists in the userLogin cancelUri parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff

A reflected cross-site scripting (xss) vulnerability exists in the charts tab selection functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364

AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php

AVideo AD_Server Stored XSS via log.php label parameter

AVideo has an incomplete fix for CVE-2026-33502 (Command Injection)

WWBN AVideo Broken Access Control via videoViewsInfo hash Parameter

WWBN AVideo Authentication Bypass via User-Agent Header

AVideo Unauthenticated Arbitrary File Write via aVideoEncoderChunk.json.php

AVideo has SQL Injection in Live_schedule::keyExists() via Unparameterized Stream Key

AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass

AVideo has an IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.php

AVideo < 20.1 ImageGallery Plugin Unauthenticated File Upload and Deletion

A cross-site scripting (xss) vulnerability exists in the videoAddNew functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364