AVideo through 29.0 CloneSite Stored Shell Injection via SSH Password CSRF

WWBN AVideo Cross-Site Request Forgery via get_domain() validation

AVideo Authentication Bypass via Unkeyed Video Hash Disclosure

WWBN AVideo Live: OS command injection in on_publish.php execAsync via unescaped m3u8 URL

AVideo has SQL Injection via Partial Prepared Statement — videos_id Concatenated Directly into Query

AVideo Vulnerable to Remote Code Execution via Persistent PHP Temp File in Encoder downloadURL with Resolution Validation Abort

AVideo has a Blind SQL Injection in Live Schedule Reminder via Unsanitized live_schedule_id in Scheduler_commands::getAllActiveOrToRepeat()

AVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission Modification

AVideo Vulnerable to OS Command Injection via Unsanitized `users_id` and `liveTransmitionHistory_id` in Restreamer Log File Path

AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload

AVideo Affected by CSRF on Plugin Import Endpoint Enables Unauthenticated Remote Code Execution via Malicious Plugin Upload

AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin

WWBN AVideo: Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction

AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)

AVideo versions prior to 20.1 permit any authenticated user to upload comment images to videos owned by other users

AVideo versions prior to 20.1 allow any authenticated user to upload files into directories belonging to other users due to an insecure direct object reference

A unrestricted php file upload vulnerability exists in the import.json.php temporary copy functionality of WWBN AVideo dev master commit 15fed957fb

An insufficient entropy vulnerability exists in the userRecoverPass.php recoverPass generation functionality of WWBN AVideo dev master commit 15fed957fb

WWBN AVideo is an open source video platform

AVideo is an open source video platform

A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364

A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364

A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364

A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364

An os command injection vulnerability exists in the aVideoEncoder wget functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364

An improper password check exists in the login functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364

A privilege escalation vulnerability exists in the session id functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364

An OS command injection vulnerability exists in the aVideoEncoder chunkfile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364

A cross-site request forgery (CSRF) vulnerability exists in WWBN AVideo 11.6 and dev master commit 3f7c0364

AVideo Platform is an open-source Audio and Video platform

The import.json.php file before 8.9 for Avideo is vulnerable to a File Deletion vulnerability

WWBN AVideo 12.4 through 29.2.0 Stored XSS via Double-Encoded Video Title

WWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHPFlix2 Templates

AVideo Bookmark Plugin Stored XSS via Chapter Names

AVideo LoginControl Stored XSS via PGP Public Key

AVideo CustomizeUser Stored XSS via field_name Parameter

AVideo Stored XSS via donationLink in watch page button

AVideo YPTWallet Stored XSS via CryptoWallet Configuration

AVideo LiveLinks Stored XSS via title and description fields

WWBN AVideo Stored XSS via Category Name and Icon Class

WWBN AVideo LoginControl Stored XSS via User-Agent Header

AVideo Unauthenticated Stream Credential Disclosure via Forgeable Token

AVideo Vulnerable to Unauthenticated CDN Configuration Takeover via Empty Default Key Bypass and Mass-Assignment in status.json.php

AVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks Proxy

AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy

WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials

WWBN AVideo Scheduler sendEmail Missing Authorization via Token

AVideo on_publish.php Missing Authentication Check via RTMP Callback

AVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment Page

AVideo has Unauthenticated SSRF via plugin/Live/test.php