World Wide Broadcast Network Avideo
10 CVEs affecting World Wide Broadcast Network Avideo. Latest disclosed: 2025-12-19. Critical: 1, High: 5.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-34434 | Critical | 9.1 | 2025-12-17 | AVideo versions prior to 20.1 with the ImageGallery plugin enabled is vulnerable to unauthenticated file upload and deletion. Plugin endpoints responsible for… |
CVE-2025-34437 | High | 8.8 | 2025-12-17 | AVideo versions prior to 20.1 permit any authenticated user to upload comment images to videos owned by other users. The endpoint validates authentication but… |
CVE-2025-34436 | High | 8.8 | 2025-12-17 | AVideo versions prior to 20.1 allow any authenticated user to upload files into directories belonging to other users due to an insecure direct object reference… |
CVE-2025-34438 | High | 8.1 | 2025-12-17 | AVideo versions prior to 20.1 contain an insecure direct object reference vulnerability allowing users with upload permissions to modify the rotation metadata… |
CVE-2025-34442 | High | 7.5 | 2025-12-17 | AVideo versions prior to 20.1 disclose absolute filesystem paths via multiple public API endpoints. Returned metadata includes full server paths to media files… |
CVE-2025-34441 | High | 7.5 | 2025-12-17 | AVideo versions prior to 20.1 expose sensitive user information through an unauthenticated public API endpoint. Responses include emails, usernames, administra… |
CVE-2025-34435 | Medium | 6.5 | 2025-12-17 | AVideo versions prior to 20.1 are vulnerable to an insecure direct object reference (IDOR) that allows any authenticated user to delete media files belonging t… |
CVE-2025-34440 | Medium | 6.1 | 2025-12-17 | AVideo versions prior to 20.1 contain an open redirect vulnerability caused by insufficient validation of the siteRedirectUri parameter during user registratio… |
CVE-2025-34439 | Medium | 6.1 | 2025-12-17 | AVideo versions prior to 20.1 are vulnerable to an open redirect flaw due to missing validation of the cancelUri parameter during user login. An attacker can c… |
CVE-2025-34433 | | 2025-12-19 | AVideo versions 14.3.1 prior to 20.1 contain an unauthenticated remote code execution vulnerability caused by predictable generation of an installation salt us… |