wwbn/avideo
Packagist142 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting wwbn/avideopage 3 of 3
- CVE-2026-35450MEDIUMCVSS 5.3EG 5.32026-04-06
vulnerable: 10.4 ... 26.0 (17 versions)
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/API/check.ffmpeg.json.php endpoint probes the FFmpeg remote server configuration and returns connectivity status without any authentication. All sibling F…
- CVE-2026-35452MEDIUMCVSS 5.3EG 5.32026-04-06
vulnerable: 10.4 ... 26.0 (17 versions)
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/CloneSite/client.log.php endpoint serves the clone operation log file without any authentication. Every other endpoint in the CloneSite plugin directory e…
- CVE-2026-39366MEDIUMCVSS 6.5EG 6.52026-04-07
vulnerable: 10.4 ... 26.0 (17 versions)
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the PayPal IPN v1 handler at plugin/PayPalYPT/ipn.php lacks transaction deduplication, allowing an attacker to replay a single legitimate IPN notification to repeate…
- CVE-2026-39367MEDIUMCVSS 5.4EG 5.42026-04-07
vulnerable: 10.4 ... 26.0 (17 versions)
WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's EPG (Electronic Program Guide) feature parses XML from user-controlled URLs and renders programme titles directly into HTML without any sanitization or esca…
- CVE-2026-40907MEDIUMCVSS 6.5EG 6.52026-04-21
vulnerable: 10.4 ... 29.0 (18 versions)
WWBN AVideo is an open source video platform. In versions 29.0 and prior, the endpoint `plugin/Live/view/Live_restreams/list.json.php` contains an Insecure Direct Object Reference (IDOR) vulnerability that allows any authenticated user wit…
- CVE-2026-40908MEDIUMCVSS 5.3EG 5.32026-04-21
vulnerable: 10.4 ... 29.0 (18 versions)
WWBN AVideo is an open source video platform. In versions 29.0 and prior, the file `git.json.php` at the web root executes `git log -1` and returns the full output as JSON to any unauthenticated user. This exposes the exact deployed commit…
- CVE-2026-40909HIGHCVSS 8.7EG 8.72026-04-21
vulnerable: 10.4 ... 29.0 (18 versions)
WWBN AVideo is an open source video platform. In versions 29.0 and prior, the locale save endpoint (`locale/save.php`) constructs a file path by directly concatenating `$_POST['flag']` into the path at line 30 without any sanitization. The…
- CVE-2026-40911CRITICALCVSS 10.0EG 10.02026-04-21
vulnerable: 10.4 ... 29.0 (18 versions)
WWBN AVideo is an open source video platform. In versions 29.0 and prior, the YPTSocket plugin's WebSocket server relays attacker-supplied JSON message bodies to every connected client without sanitizing the `msg` or `callback` fields. On …
- CVE-2026-40925HIGHCVSS 8.3EG 8.32026-04-21
vulnerable: 10.4 ... 29.0 (18 versions)
WWBN AVideo is an open source video platform. In versions 29.0 and prior, `objects/configurationUpdate.json.php` (also routed via `/updateConfig`) persists dozens of global site settings from `$_POST` but protects the endpoint only with `U…
- CVE-2026-40926HIGHCVSS 7.1EG 7.12026-04-21
vulnerable: 10.4 ... 29.0 (18 versions)
WWBN AVideo is an open source video platform. In versions 29.0 and prior, three admin-only JSON endpoints — `objects/categoryAddNew.json.php`, `objects/categoryDelete.json.php`, and `objects/pluginRunUpdateScript.json.php` — enforce on…
- CVE-2026-40928MEDIUMCVSS 5.4EG 5.42026-04-21
vulnerable: 10.4 ... 29.0 (18 versions)
WWBN AVideo is an open source video platform. In versions 29.0 and prior, multiple AVideo JSON endpoints under `objects/` accept state-changing requests via `$_REQUEST`/`$_GET` and persist changes tied to the caller's session user, without…
- CVE-2026-40929MEDIUMCVSS 5.4EG 5.42026-04-21
vulnerable: 10.4 ... 29.0 (18 versions)
WWBN AVideo is an open source video platform. In versions 29.0 and prior, `objects/commentDelete.json.php` is a state-mutating JSON endpoint that deletes comments but performs no CSRF validation. It does not call `forbidIfIsUntrustedReques…
- CVE-2026-40935MEDIUMCVSS 5.3EG 5.32026-04-21
vulnerable: 10.4 ... 29.0 (18 versions)
WWBN AVideo is an open source video platform. In versions 29.0 and prior, `objects/getCaptcha.php` accepts the CAPTCHA length (`ql`) directly from the query string with no clamping or sanitization, letting any unauthenticated client force …
- CVE-2026-41055HIGHCVSS 8.6EG 8.62026-04-21
vulnerable: 10.4 ... 29.0 (18 versions)
WWBN AVideo is an open source video platform. In versions 29.0 and below, an incomplete SSRF fix in AVideo's LiveLinks proxy adds `isSSRFSafeURL()` validation but leaves DNS TOCTOU vulnerabilities where DNS rebinding between validation and…
- CVE-2026-41056HIGHCVSS 8.1EG 8.12026-04-21
vulnerable: 10.4 ... 29.0 (18 versions)
WWBN AVideo is an open source video platform. In versions 29.0 and below, the `allowOrigin($allowAll=true)` function in `objects/functions.php` reflects any arbitrary `Origin` header back in `Access-Control-Allow-Origin` along with `Access…
- CVE-2026-41057HIGHCVSS 7.1EG 7.12026-04-21
vulnerable: 10.4 ... 29.0 (18 versions)
WWBN AVideo is an open source video platform. In versions 29.0 and below, the CORS origin validation fix in commit `986e64aad` is incomplete. Two separate code paths still reflect arbitrary `Origin` headers with credentials allowed for all…
- CVE-2026-41058HIGHCVSS 8.1EG 8.12026-04-21
vulnerable: 10.4 ... 29.0 (18 versions)
WWBN AVideo is an open source video platform. In versions 29.0 and below, the incomplete fix for AVideo's CloneSite `deleteDump` parameter does not apply path traversal filtering, allowing `unlink()` of arbitrary files via `../../` sequenc…
- CVE-2026-41060HIGHCVSS 7.7EG 7.72026-04-21
vulnerable: 10.4 ... 29.0 (18 versions)
WWBN AVideo is an open source video platform. In versions 29.0 and below, the `isSSRFSafeURL()` function in `objects/functions.php` contains a same-domain shortcircuit (lines 4290-4296) that allows any URL whose hostname matches `webSiteRo…
- CVE-2026-41061MEDIUMCVSS 5.4EG 5.42026-04-21
vulnerable: 10.4 ... 29.0 (18 versions)
WWBN AVideo is an open source video platform. In versions 29.0 and below, the `isValidDuration()` regex at `objects/video.php:918` uses `/^[0-9]{1,2}:[0-9]{1,2}:[0-9]{1,2}/` without a `$` end anchor, allowing arbitrary HTML/JavaScript to b…
- CVE-2026-41062MEDIUMCVSS 6.5EG 6.52026-04-21
vulnerable: 10.4 ... 29.0 (18 versions)
WWBN AVideo is an open source video platform. In versions 29.0 and below, the directory traversal fix introduced in commit 2375eb5e0 for `objects/aVideoEncoderReceiveImage.json.php` only checks the URL path component (via `parse_url($url, …
- CVE-2026-41063MEDIUMCVSS 5.4EG 5.42026-04-21
vulnerable: 10.4 ... 29.0 (18 versions)
WWBN AVideo is an open source video platform. In versions 29.0 and below, an incomplete XSS fix in AVideo's `ParsedownSafeWithLinks` class overrides `inlineMarkup` for raw HTML but does not override `inlineLink()` or `inlineUrlTag()`, allo…
- CVE-2026-41064CRITICALCVSS 9.3EG 9.32026-04-22
vulnerable: 10.4 ... 29.0 (18 versions)
WWBN AVideo is an open source video platform. In versions up to and including 29.0, an incomplete fix for AVideo's `test.php` adds `escapeshellarg` for wget but leaves the `file_get_contents` and `curl` code paths unsanitized, and the URL …
- CVE-2026-41304CRITICALCVSS 9.8EG 9.82026-04-22
vulnerable: 10.4 ... 29.0 (18 versions)
WWBN AVideo is an open source video platform. In versions 29.0 and below, the `cloneServer.json.php` endpoint in the CloneSite plugin constructs shell commands using user-controlled input (`url` parameter) without proper sanitization. The …
- CVE-2026-43873HIGHCVSS 7.5EG 7.52026-05-11
vulnerable: 10.4 ... 29.0 (18 versions)
WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/CloneSite/cloneClient.json.php echoes the local CloneSite shared secret ($objClone->myKey, a constant md5($global['systemRootPath'] . $global['salt'…
- CVE-2026-43874HIGHCVSS 7.2EG 7.22026-05-11
vulnerable: 10.4 ... 29.0 (18 versions)
WWBN AVideo is an open source video platform. In versions up to and including 29.0, the server-side mitigation for the YPTSocket autoEvalCodeOnHTML eval sink (from CVE-2026-40911) only strips the payload when it sits under $json['msg'], bu…
- CVE-2026-43875MEDIUMCVSS 6.8EG 6.82026-05-11
vulnerable: 10.4 ... 29.0 (18 versions)
WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/MobileManager/oauth2.php completes an OAuth login by sending an HTTP 302 Location: oauth2Success.php?user=<email>&pass=<HASH> where <HASH> is the vi…
- CVE-2026-43876MEDIUMCVSS 6.4EG 6.42026-05-11
vulnerable: 10.4 ... 29.0 (18 versions)
WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/notifySubscribers.json.php takes the raw message POST parameter and passes it into sendSiteEmail(), which substitutes it directly into an HTML emai…
- CVE-2026-43877MEDIUMCVSS 5.4EG 5.42026-05-11
vulnerable: 10.4 ... 29.0 (18 versions)
WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/userSavePhoto.php is a legacy profile-photo endpoint that accepts a base64 POST parameter and writes the decoded bytes to videos/userPhoto/photo<us…
- CVE-2026-43878MEDIUMCVSS 6.1EG 6.12026-05-11
vulnerable: 10.4 ... 29.0 (18 versions)
WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/Meet/iframe.php echoes the attacker-controlled user and pass query parameters unescaped into a JavaScript double-quoted string literal inside a <scr…
- CVE-2026-43879MEDIUMCVSS 5.4EG 5.42026-05-11
vulnerable: 10.4 ... 29.0 (18 versions)
WWBN AVideo is an open source video platform. In versions up to and including 29.0, an authenticated user can configure their own donation-notification webhook URL to point at internal/loopback/metadata hosts (e.g. http://127.0.0.1:8080/..…
- CVE-2026-43880MEDIUMCVSS 5.3EG 5.32026-05-11
vulnerable: 10.4 ... 29.0 (18 versions)
WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/sendEmail.json.php exposes two branches depending on whether contactForm=1 is submitted. When the parameter is omitted, the endpoint sets $sendTo t…
- CVE-2026-43881MEDIUMCVSS 5.3EG 5.32026-05-11
vulnerable: 10.4 ... 29.0 (18 versions)
WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/users.json.php exposes two unauthenticated paths that disclose the full set of registered user accounts. The isCompany request parameter causes the…
- CVE-2026-43882MEDIUMCVSS 4.3EG 4.32026-05-11
vulnerable: 10.4 ... 29.0 (18 versions)
WWBN AVideo is an open source video platform. In versions up to and including 29.0, the unauthenticated plugin/Scheduler/downloadICS.php endpoint passes attacker-controlled title, description, and joinURL parameters into Scheduler::downloa…
- CVE-2026-43883MEDIUMCVSS 4.2EG 4.22026-05-11
vulnerable: 10.4 ... 29.0 (18 versions)
WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/PayPalYPT/agreementCancel.json.php cancels a PayPal billing agreement using an attacker-supplied agreement parameter without verifying that the auth…
- CVE-2026-43884HIGHCVSS 7.7EG 7.72026-05-11
vulnerable: 10.4 ... 29.0 (18 versions)
WWBN AVideo is an open source video platform. In versions up to and including 29.0, two endpoints (plugin/AI/receiveAsync.json.php and objects/EpgParser.php) in AVideo call isSSRFSafeURL() to validate user-supplied URLs, then fetch them us…
- CVE-2026-43885HIGHCVSS 7.7EG 7.72026-05-11
vulnerable: 10.4 ... 29.0 (18 versions)
WWBN AVideo is an open source video platform. In versions up to and including 29.0, an unauthenticated user can read APISecret from objects/plugins.json.php and use it to call protected API endpoints (e.g. users_list) without logging in. C…
- CVE-2026-49279HIGHCVSS 7.7EG 7.72026-06-04
vulnerable: 10.4 ... 29.0 (18 versions)
WWBN AVideo is an open source video platform. Versions 29.0 and below contain a Stored XSS vulnerability through the autoEvalCodeOnHTML parameter in the MessageSQLite WebSocket Handler. The MessageSQLite.php handler only strips autoEvalCod…
- CVE-2026-55173HIGHCVSS 8.1EG 8.12026-06-23
vulnerable: 10.4 ... 29.0 (18 versions)
WWBN AVideo is an open source video platform. Versions 29.0 and below remain vulnerable to OS command injection because the fix for CVE-2026-33482 was incomplete and still does not neutralize a single & ( the shell background operator). C…
- CVE-2026-56341HIGHCVSS 7.5EG 7.52026-06-20
vulnerable: 10.4 ... 26.0 (17 versions)
AVideo through version 26.0 contains multiple unauthenticated list.json.php endpoints in payment plugins lacking authorization checks, exposing PayPal tokens, Authorize.Net webhooks, and Bitcoin transaction records. Unauthenticated attacke…
- CVE-2026-56346MEDIUMCVSS 6.5EG 6.52026-06-20
vulnerable: 10.4 ... 25.0 (16 versions)
AVideo through version 25.0 contains an authentication bypass vulnerability in the decryptMessage.json.php endpoint that allows unauthenticated users to decrypt PGP messages. Remote attackers can submit private keys, ciphertext, and passph…
- CVE-2026-56347MEDIUMCVSS 6.1EG 6.12026-06-20
vulnerable: 10.4 ... 26.0 (17 versions)
AVideo TopMenu plugin through version 26.0 contains a stored cross-site scripting vulnerability in menu item rendering due to missing output encoding of icon classes, URLs, and text labels. Attackers can inject malicious JavaScript through…
- CVE-2026-60092MEDIUMCVSS 6.1EG 6.12026-07-08
vulnerable: 10.4 ... 29.0 (18 versions)
AVideo (Meet plugin) through commit e8d6119f3cb1b849149906efeb0a41fc024f59f8 contains a stored cross-site scripting vulnerability in the Meet plugin's getMeetInfo.json.php endpoint. When a participant joins a public meeting, the raw HTTP U…
Check whether wwbn/avideo is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for wwbn/avideo CVEs against the assets you own.
Start Free Scan →