Composer wwbn/avideo has 160 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2024-31819 | WWBN AVideo Remote Code Execution | critical | 9.8 | >=12.4 and <14.3 | 14.3 |
| CVE-2026-33478 | AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection | critical | 10.0 | <=26.0 | – |
| CVE-2026-29058 | WWBN AVideo is vulnerable to unauthenticated OS Command Injection via base64Url in objects/getImage.php | critical | 9.8 | <7.0.0 | 7.0.0 |
| CVE-2023-32073 | WWBN AVideo command injection vulnerability | high | 8.8 | <=12.4 | – |
| CVE-2023-30854 | Remote code injection in wwbn/avideo | high | 8.8 | <12.4 | 12.4 |
| CVE-2026-33482 | AVideo has an OS Command Injection via $() Shell Substitution Bypass in sanitizeFFmpegCommand() | high | 8.1 | <=26.0 | – |
| CVE-2026-55173 | AVideo has an incomplete fix of CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command exe | high | 8.1 | <=29.0 | – |
| CVE-2020-23489 | AVideo vulnerable to Improper Privilege Management | high | 8.8 | <8.9 | 8.9 |
| CVE-2026-41304 | WWBN AVideo: RCE cause by clonesite plugin | critical | 9.8 | <=29.0 | – |
| CVE-2026-28501 | AVideo has Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php | critical | 9.8 | <=21.0.0 | – |
| CVE-2023-25313 | AVideo contains Command injection when embedding a video link | critical | 9.6 | <12.4 | 12.4 |
| CVE-2023-49599 | WWBN AVideo Insufficient Entropy vulnerbaility | critical | 9.8 | <=12.4 | – |
| CVE-2023-50172 | WWBN AVideo recovery notification bypass vulnerability | medium | 5.3 | <=12.4 | – |
| CVE-2026-33513 | AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP) | high | 8.6 | <=26.0 | – |
| CVE-2026-41062 | WWBN AVideo has an Incomplete fix: Directory traversal bypass via query string in ReceiveImage downloadURL parameters | medium | 6.5 | <=29.0 | – |
| CVE-2023-30860 | WWBN/AVideo stored XSS vulnerability leads to takeover of any user's account, including admin's account | high | 8.0 | <12.4 | 12.4 |
| CVE-2026-33292 | AVideo has an Authorization Bypass via Path Traversal in HLS Endpoint Allows Streaming Private/Paid Videos | high | 7.5 | <=25.0 | – |
| CVE-2026-28502 | AVideo has Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction | critical | 0.0 | all versions | – |
| CVE-2023-49810 | WWBN AVideo Improper Restriction of Excessive Authentication Attempts vulnerability | high | 7.3 | <=12.4 | – |
| CVE-2026-40909 | WWBN AVideo has a Path Traversal in Locale Save Endpoint Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE) | high | 8.7 | <=29.0 | – |
| CVE-2026-33647 | AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload | high | 8.8 | <=26.0 | – |
| CVE-2026-40911 | WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks | critical | 10.0 | <=29.0 | – |
| CVE-2026-33648 | AVideo Vulnerable to OS Command Injection via Unsanitized `users_id` and `liveTransmitionHistory_id` in Restreamer Log File Path | high | 8.8 | <=26.0 | – |
| CVE-2022-27463 | Open redirect in wwbn/avideo | medium | 6.1 | <=11.6 | – |
| CVE-2026-33483 | AVideo Affected by Unauthenticated Disk Space Exhaustion via Unlimited Temp File Creation in aVideoEncoderChunk.json.php | high | 7.5 | <=26.0 | – |
| CVE-2026-56346 | AVideo has Unauthenticated PGP Message Decryption via Public Endpoint | medium | 0.0 | <=25.0 | – |
| CVE-2026-33479 | AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin | high | 8.8 | <=26.0 | – |
| CVE-2026-33767 | AVideo has SQL Injection via Partial Prepared Statement — videos_id Concatenated Directly into Query | high | 0.0 | <26.0 | 26.0 |
| CVE-2026-33352 | AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass) | critical | 9.8 | <=26.0 | – |
| CVE-2026-33293 | AVideo Affected by Arbitrary File Deletion via Path Traversal in CloneSite deleteDump Parameter | high | 8.1 | <=25.0 | – |
| CVE-2026-29093 | AVideo: Unauthenticated PHP session store exposed to host network via published memcached port | high | 8.1 | <=21.0 | – |
| CVE-2026-33038 | AVideo affected by unauthenticated application takeover via exposed web installer on uninitialized deployments | high | 8.1 | <=25.0 | – |
| CVE-2026-33681 | AVideo has Path Traversal in pluginRunDatabaseScript.json.php Enables Arbitrary SQL File Execution via Unsanitized Plugin Name | high | 7.2 | <=26.0 | – |
| CVE-2026-33770 | AVideo has SQL Injection in category.php fixCleanTitle() via Unparameterized clean_title and id Variables | high | 0.0 | <=26.0 | – |
| CVE-2026-34731 | AVideo: Unauthenticated Live Stream Termination via RTMP Callback on_publish_done.php | high | 7.5 | <=26.0 | – |
| CVE-2026-33485 | AVideo has an Unauthenticated Blind SQL Injection in RTMP on_publish Callback via Stream Name Parameter | high | 7.5 | <=26.0 | – |
| CVE-2026-41058 | WWBN AVideo has an incomplete fix for CVE-2026-33293: Path Traversal | high | 8.1 | <=29.0 | – |
| CVE-2026-45731 | AVideo: Authenticated Arbitrary File Read in view/update.php | medium | 4.9 | <=29.0 | – |
| CVE-2026-33039 | AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy | high | 8.6 | <=25.0 | – |
| CVE-2026-56341 | AVideo: Unauthenticated Access to Payment Log DataTables Endpoints Exposes Transaction Data, PayPal Tokens, and User Financial Records | high | 7.5 | <=26.0 | – |
| CVE-2024-34899 | AVideo cross-site scripting vulnerability in the view/about.php page | medium | 6.1 | <14.3 | 14.3 |
| CVE-2026-46337 | AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php` | medium | 5.3 | <=29.0 | – |
| CVE-2026-56345 | AVideo's Meet plugin: `uploadRecordedVideo.json.php` derives `users_id` from the uploaded filename and calls passwordless `User->login()`, a | high | 8.1 | <=29.0 | – |
| CVE-2026-33502 | AVideo has Unauthenticated SSRF via plugin/Live/test.php | critical | 9.3 | <=26.0 | – |
| CVE-2026-33501 | AVideo has Unauthenticated Information Disclosure of User Group Permission Mappings via Permissions Plugin | medium | 5.3 | <=26.0 | – |
| CVE-2026-33716 | AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php | critical | 9.4 | <=26.0 | – |
| CVE-2026-33351 | AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass | critical | 9.1 | <=26.0 | – |
| CVE-2026-33238 | AVideo has a Path Traversal in listFiles.json.php Enables Server Filesystem Enumeration | medium | 4.3 | <26.0 | 26.0 |
| CVE-2026-39369 | WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLs | high | 7.6 | <=26.0 | – |
| CVE-2026-49279 | WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass) | high | 0.0 | <=29.0 | – |
| CVE-2026-33717 | AVideo: Remote Code Execution via PHP Temp File in Encoder downloadURL | high | 8.8 | <=26.0 | – |
| CVE-2026-33761 | AVideo: Unauthenticated Access to Scheduler Plugin Endpoints Leaks Scheduled Tasks, Email Content, and User Mappings | medium | 5.3 | <=26.0 | – |
| CVE-2026-34369 | AVideo has Video Password Protection Bypass via API Endpoints Returning Full Playback Sources Without Password Verification | medium | 5.3 | <=26.0 | – |
| CVE-2026-30885 | AVideo has Unauthenticated IDOR - Playlist Information Disclosure | medium | 0.0 | <25.0 | 25.0 |
| CVE-2026-34732 | AVideo: Missing Authentication in CreatePlugin list.json.php Template Affects 21 Endpoints | medium | 5.3 | <=26.0 | – |
| CVE-2026-54458 | WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin | critical | 9.6 | <=29.0 | – |
| CVE-2026-41055 | WWBN AVideo has an incomplete fix for CVE-2026-33039: SSRF | medium | 5.3 | <=29.0 | – |
| CVE-2026-33507 | AVideo Affected by CSRF on Plugin Import Endpoint Enables Unauthenticated Remote Code Execution via Malicious Plugin Upload | high | 8.8 | <=26.0 | – |
| CVE-2026-35450 | AVideo: Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php | medium | 5.3 | <=26.0 | – |
| CVE-2026-35452 | AVideo: Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php | medium | 5.3 | <=26.0 | – |
| CVE-2026-33719 | AVideo: Unauthenticated CDN Configuration Takeover via Empty Default Key Bypass and Mass-Assignment | high | 8.6 | <=26.0 | – |
| CVE-2026-33297 | AVideo: IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.php | medium | 0.0 | <=25.0 | – |
| CVE-2026-33651 | AVideo has a Blind SQL Injection in Live Schedule Reminder via Unsanitized live_schedule_id in Scheduler_commands::getAllActiveOrToRepeat() | high | 8.1 | <=26.0 | – |
| CVE-2026-33043 | AVideo affected by Session Hijacking via Unauthenticated Session ID Disclosure with Permissive CORS | high | 8.1 | <=25.0 | – |
| CVE-2026-33237 | AVideo has SSRF in Scheduler Plugin via callbackURL Missing `isSSRFSafeURL()` Validation | medium | 5.5 | <26.0 | 26.0 |
| CVE-2026-43884 | AVideo has SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL() | high | 7.7 | <=29.0 | – |
| CVE-2026-33692 | AVideo Vulnerable to Unauthenticated .env File Exposure via Official Docker Compose Configuration | high | 7.5 | <29.0 | 29.0 |
| CVE-2026-34733 | AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard | medium | 6.5 | <=26.0 | – |
| CVE-2026-33493 | AVideo has a Path Traversal in import.json.php Allows Private Video Theft and Arbitrary File Read/Deletion via fileURI Parameter | high | 7.1 | <=26.0 | – |
| CVE-2026-33041 | AVideo has an Unauthenticated Password Hash Oracle via encryptPass.json.php | medium | 5.3 | <=25.0 | – |
| CVE-2026-41064 | WWBN AVideo has an incomplete fix for CVE-2026-33502: Command Injection | critical | 9.3 | <=29.0 | – |
| CVE-2026-41056 | WWBN AVideo has CORS Origin Reflection with Credentials on Sensitive API Endpoints Enables Cross-Origin Account Takeover | high | 8.1 | <=29.0 | – |
| CVE-2026-43885 | AVideo Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization | high | 0.0 | <=29.0 | – |
| CVE-2026-43875 | AVideo: Password Hash Leak in MobileManager OAuth Redirect URL Enables Account Takeover | medium | 6.8 | <=29.0 | – |
| CVE-2026-33763 | AVideo has an Unauthenticated Video Password Brute-Force Vulnerability via Unrate-Limited Boolean Oracle | medium | 5.3 | <=26.0 | – |
| CVE-2026-34364 | AVideo has User Group-Based Category Access Control Bypass via Missing and Broken Group Filtering in categories.json.php | medium | 5.3 | <=26.0 | – |
| CVE-2026-35449 | AVideo: Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.php | medium | 5.3 | <=26.0 | – |
| CVE-2026-34395 | AVideo vulnerable to Mass User PII Disclosure via Missing Authorization in YPTWallet users.json.php | medium | 6.5 | <=26.0 | – |
| CVE-2026-34740 | AVideo: Stored SSRF via Video EPG Link Missing isSSRFSafeURL() Validation | medium | 6.5 | <=26.0 | – |
| CVE-2026-33319 | AVideo has an OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command | medium | 5.9 | <=25.0 | – |
| CVE-2026-33480 | AVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks Proxy | high | 8.6 | <=26.0 | – |
| CVE-2026-33035 | Unauthenticated Reflected XSS via innerHTML in AVideo | medium | 0.0 | <=25.0 | – |
| CVE-2026-43873 | AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configure | high | 7.5 | <=29.0 | – |
| CVE-2026-33685 | AVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User Data | medium | 5.3 | <=26.0 | – |
| CVE-2026-43881 | AVideo: Unauthenticated User Enumeration in objects/users.json.php via isCompany Parameter Allows Bypass of the Admin-Only Listing Restricti | medium | 5.3 | <=29.0 | – |
| CVE-2026-45578 | AVideo: OS command injection in on_publish.php execAsync via unescaped m3u8 URL | high | 8.8 | <=29.0 | – |
| CVE-2026-35448 | AVideo: Unauthenticated Access to Payment Order Data via BlockonomicsYPT check.php | low | 3.7 | <=26.0 | – |
| CVE-2026-33759 | AVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist Contents | medium | 5.3 | <=26.0 | – |
| CVE-2026-34375 | AVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment Page | high | 8.2 | <=26.0 | – |
| CVE-2026-33492 | AVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session Regeneration | high | 7.3 | <=26.0 | – |
| CVE-2026-41060 | WWBN AVideo has a SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL | high | 7.7 | <=29.0 | – |
| CVE-2026-43874 | AVideo has an Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']` Rela | high | 7.2 | <=29.0 | – |
| CVE-2026-43880 | AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Enables Phishing from the Site’s Legitimate From Address | medium | 5.3 | <=29.0 | – |
| CVE-2026-34737 | AVideo: Arbitrary Stripe Subscription Cancellation via Debug Endpoint and retrieveSubscriptions() Bug | medium | 6.5 | <=26.0 | – |
| CVE-2026-34716 | AVideo: DOM XSS via Unsanitized Display Name in WebSocket Call Notification | medium | 6.4 | <=26.0 | – |
| CVE-2026-33688 | AVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery Endpoint | medium | 5.3 | <=26.0 | – |
| CVE-2026-33294 | AVideo Affected by SSRF in BulkEmbed Thumbnail Fetch Allows Reading Internal Network Resources | medium | 5.0 | <=25.0 | – |
| CVE-2026-27732 | AVideo has Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.php | high | 8.1 | <22.0 | 22.0 |
| CVE-2026-40907 | WWBN AVideo has an IDOR in Live Restreams list.json.php Exposes Other Users' Stream Keys and OAuth Tokens | medium | 6.5 | <=29.0 | – |
| CVE-2026-27568 | AVideo has Stored Cross-Site Scripting via Markdown Comment Injection | medium | 0.0 | <21.0 | 21.0 |
| CVE-2026-33488 | AVideo has a PGP 2FA Bypass via Cryptographically Broken 512-bit RSA Key Generation in LoginControl Plugin | high | 7.4 | <=26.0 | – |
| CVE-2026-33354 | AVideo has an authenticated arbitrary local file read via `chunkFile` path injection in `aVideoEncoder.json.php` | high | 7.6 | <=26.0 | – |
| CVE-2026-34245 | AVideo: Missing Authorization in Playlist Schedule Creation Allows Cross-User Broadcast Hijacking | medium | 6.3 | <=26.0 | – |
| CVE-2026-43878 | Video: Reflected XSS in plugin/Meet/iframe.php via Unescaped user and pass Parameters in JavaScript String Literal | medium | 6.1 | <=29.0 | – |
| CVE-2026-60092 | AVideo Meet plugin: anonymous-to-admin stored XSS via unescaped participant User-Agent in getMeetInfo.json.php Participants panel | medium | 0.0 | <=29.0 | – |
| CVE-2026-34362 | AVideo's WebSocket Token Never Expires Due to Commented-Out Timeout Validation in verifyTokenSocket() | medium | 5.4 | <=26.0 | – |
| CVE-2026-40908 | WWBN AVideo has an Unauthenticated Information Disclosure via git.json.php Exposes Developer Emails and Deployed Version | medium | 5.3 | <=29.0 | – |
| CVE-2026-34247 | AVideo: IDOR in uploadPoster.php Allows Any Authenticated User to Overwrite Scheduled Live Stream Posters and Trigger False Socket Notificat | medium | 5.4 | <=26.0 | – |
| CVE-2026-33684 | AVideo's Privilege Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet Permissions | medium | 5.3 | <29.0 | 29.0 |
| CVE-2026-33650 | AVideo: Video Moderator Privilege Escalation via Ownership Transfer Enables Arbitrary Video Deletion | high | 7.6 | <=26.0 | – |
| CVE-2026-33512 | AVideo has an unauthenticated decrypt oracle leaking any ciphertext | high | 7.5 | <=26.0 | – |
| CVE-2026-34394 | AVideo's CSRF on Admin Plugin Configuration Enables Payment Credential Hijacking | high | 8.1 | <=26.0 | – |
| CVE-2026-34738 | AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter | medium | 4.3 | <=26.0 | – |
| CVE-2026-33766 | AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints | medium | 0.0 | <=26.0 | – |
| CVE-2026-33499 | AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php | medium | 6.1 | <=26.0 | – |
| CVE-2026-34368 | AVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalance | medium | 5.3 | <=26.0 | – |
| CVE-2026-33723 | AVideo is Vulnerable to SQL Injection through Subscribe Endpoint via Unsanitized user_id Parameter | high | 7.1 | <=26.0 | – |
| CVE-2026-34396 | AVideo has Stored XSS via Unescaped Plugin Configuration Values in Admin Panel | medium | 6.1 | <=26.0 | – |
| CVE-2026-33500 | AVideo - Incomplete Fix for CVE-2026-27568: Stored XSS via Markdown `javascript:` URI Bypasses ParsedownSafeWithLinks Sanitization | medium | 5.4 | <=26.0 | – |
| CVE-2026-34739 | AVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.php | medium | 6.1 | <=26.0 | – |
| CVE-2026-33764 | AVideo: IDOR in AI Plugin Allows Stealing Other Users' AI-Generated Metadata and Transcriptions | medium | 4.3 | <=26.0 | – |
| CVE-2026-50182 | WWBN AVideo: Unauthenticated Reflected XSS via $_GET['search'] in AVideo YouTubeAPI Gallery Pagination | medium | 6.1 | <=29.0 | – |
| CVE-2026-33295 | AVideo Affected by Stored XSS via Unescaped Video Title in CDN downloadButtons.php | high | 0.0 | <=25.0 | – |
| CVE-2026-40935 | CAPTCHA Bypass in WWBN/AVideo via Attacker-Controlled Length Parameter and Missing Token Invalidation on Failure | medium | 5.3 | <=29.0 | – |
| CVE-2026-41063 | WWBN AVideo has an incomplete fix for CVE-2026-33500: XSS | medium | 5.4 | <=29.0 | – |
| CVE-2026-35179 | AVideo: Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php | medium | 5.3 | <=26.0 | – |
| CVE-2026-43882 | AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event Spoofing | medium | 4.3 | <=29.0 | – |
| CVE-2026-39368 | WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services | medium | 6.5 | <=26.0 | – |
| CVE-2026-39370 | WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration (Incomplete fix | high | 7.1 | <=26.0 | – |
| CVE-2026-34613 | AVideo: CSRF on Plugin Enable/Disable Endpoint Allows Disabling Security Plugins | medium | 6.5 | <=26.0 | – |
| CVE-2026-56347 | AVideo has Stored XSS via Unescaped Menu Item Fields in TopMenu Plugin | medium | 6.1 | <=26.0 | – |
| CVE-2026-43883 | AVideo: IDOR in PayPalYPT Plugin Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription Agreements | medium | 4.2 | <=29.0 | – |
| CVE-2026-43879 | AVideo has Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT_FOLLOWLOCATION Redirect Bypass | medium | 5.4 | <=29.0 | – |
| CVE-2026-50183 | WWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery Section | medium | 4.7 | <=29.0 | – |
| CVE-2026-39367 | WWBN AVideo has Stored XSS via Malicious EPG XML Program Titles in AVideo EPG Page | medium | 5.4 | <=26.0 | – |
| CVE-2026-45620 | AVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumeration sibling that survives `d9cdc7024 | medium | 5.3 | <=29.0 | – |
| CVE-2026-33296 | AVideo has an Open Redirect via Unvalidated redirectUri in userLogin.php | low | 0.0 | <=25.0 | – |
| CVE-2026-43876 | AVideo: HTML Injection in notifySubscribers.json.php Allows Platform-Branded Phishing Emails to Channel Subscribers | medium | 6.4 | <=29.0 | – |
| CVE-2026-33683 | AVideo vulnerable to Stored XSS via html_entity_decode() Reversing xss_esc() Sanitization in Channel About Field | medium | 5.4 | <=26.0 | – |
| CVE-2026-33690 | AVideo vulnerable to IP Address Spoofing via Untrusted HTTP Headers in getRealIpAddr() | medium | 5.3 | <=26.0 | – |
| CVE-2026-33649 | AVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission Modification | high | 8.1 | <=26.0 | – |
| CVE-2026-40925 | WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials | high | 8.3 | <=29.0 | – |
| CVE-2026-41061 | WWBN AVideo has Stored XSS via Unanchored Duration Regex in Video Encoder Receiver | medium | 5.4 | <=29.0 | – |
| CVE-2026-39366 | WWBN AVideo Affected by a PayPal IPN Replay Attack Enabling Wallet Balance Inflation via Missing Transaction Deduplication in ipn.php | medium | 6.5 | <=26.0 | – |
| CVE-2026-40926 | WWBN AVideo has Multiple CSRF Vulnerabilities in Admin JSON Endpoints (Category CRUD, Plugin Update Script) | high | 7.1 | <=29.0 | – |
| CVE-2026-33731 | AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data | medium | 6.5 | <29.0 | 29.0 |
| CVE-2026-47694 | WWBN AVideo: Stored XSS via unescaped Gallery category description | medium | 5.4 | <=29.0 | – |
| CVE-2026-34611 | AVideo: CSRF on emailAllUsers.json.php Enables Mass Phishing Email to All Users | medium | 6.5 | <=26.0 | – |
| CVE-2026-33867 | AVideo has Plaintext Video Password Storage | critical | 0.0 | <=26.0 | – |
| CVE-2026-43877 | AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Authenticated Users' Profile Photos with Arbitrary Content | medium | 5.4 | <=29.0 | – |
| CVE-2026-45619 | AVideo CVE-2026-43884 incomplete fix - six (or more) `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD p | medium | 6.5 | <=29.0 | – |
| CVE-2026-45580 | AVideo: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute | medium | 5.4 | <=29.0 | – |
| CVE-2026-35181 | AVideo: CSRF on Player Skin Configuration via admin/playerUpdate.json.php | medium | 4.3 | <=26.0 | – |
| CVE-2026-41057 | WWBN AVideo has a CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) Exposes Authenticated API Responses | high | 7.1 | <=29.0 | – |
| CVE-2026-47696 | WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint | medium | 4.3 | <=29.0 | – |
| CVE-2026-40928 | WWBN AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset | medium | 5.4 | <=29.0 | – |
| CVE-2026-40929 | WWBN AVideo is missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creato | medium | 5.4 | <=29.0 | – |
| CVE-2026-45610 | AVideo: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA | medium | 5.7 | <=29.0 | – |
| GHSA-wxjx-r2j2-96fx | AVideo: Full-Read SSRF Through Unvalidated statsURL Parameter in plugin/Live/test.php | medium | 4.9 | <=26.0 | – |
| GHSA-2fch-hv74-fgw9 | Cross site scripting (XSS) in wwbn/avideo | high | 0.0 | <12.4 | 12.4 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked