CVE-2026-100630 | Medium | 5.4 | 2026-09-26 | AVideo contains a stored cross-site scripting vulnerability in the video trailer1 field rendered unsanitized within an inline onclick JavaScript string. Attack… |
CVE-2026-92915 | High | 7.3 | 2026-09-17 | WWBN AVideo through commit e01e41ecc (no patched version available) contains a broken access control flaw in objects/userVerifyEmail.php. The script disables t… |
CVE-2026-92914 | High | 8.1 | 2026-09-17 | AVideo LoginControl contains an authentication bypass vulnerability in the PGP second factor verification that compares challenge responses using loose equalit… |
CVE-2026-92913 | High | 7.4 | 2026-09-17 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 uses a cryptographically weak pseudo-random number generator when creating account activation /… |
CVE-2026-92912 | Medium | 6.5 | 2026-09-17 | AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 uses cryptographically weak uniqid() values for RTMP publish keys in LiveTransmition, reducing key entr… |
CVE-2026-92586 | Medium | 4.3 | 2026-09-16 | AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to verify video access permissions in the set_api_comment function, allowing authen… |
CVE-2026-92585 | Medium | 4.3 | 2026-09-16 | AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to validate video access permissions in the API like endpoint, allowing logged-in u… |
CVE-2026-92584 | Medium | 6.1 | 2026-09-16 | AVideo through 29.0 (current revision e01e41ecc) contains a stored cross-site scripting vulnerability. The unauthenticated view-counter endpoint objects/videoA… |
CVE-2026-92583 | Medium | 6.5 | 2026-09-16 | AVideo through 29.0 contains a race condition in the enforceRateLimit() function that fails to atomically increment rate limit counters, allowing attackers to… |
CVE-2026-92582 | High | 7.1 | 2026-09-16 | AVideo (WWBN/AVideo) through 29.0 (commit e01e41ecc) is vulnerable to cross-site request forgery. objects/videoAddNew.json.php disables AVideo's automatic CSRF… |
CVE-2026-92581 | Medium | 4.3 | 2026-09-16 | In AVideo through 29.0, Like::__construct() performs counter arithmetic on raw request values before validation, allowing array-typed parameters to desynchroni… |
CVE-2026-92580 | High | 8.8 | 2026-09-16 | In AVideo through 29.0, the CloneSite plugin is vulnerable to stored OS command injection. In plugin/CloneSite/cloneClient.json.php (line ~270) the stored SSH… |
CVE-2026-92579 | Medium | 5.4 | 2026-09-16 | In AVideo through 29.0, the autoCSRFGuard() function maintains a hardcoded allowlist of exempt basenames tested without directory context, allowing plugin file… |
CVE-2026-92578 | High | 8.1 | 2026-09-16 | WWBN AVideo through 29.0 contains an authentication bypass vulnerability where the stored password hash is accepted as a valid login credential through two ind… |
CVE-2026-92577 | High | 7.5 | 2026-09-16 | In AVideo through 29.0, the API get_api_video endpoint contains a broken access control vulnerability in the clean_title branch that returns user-group-restric… |
CVE-2026-91967 | Medium | 5.0 | 2026-09-15 | AVideo through 29.0 contains a blind server-side request forgery vulnerability in the getHeaderContentTypeFromURL function that issues get_headers() calls guar… |
CVE-2026-91966 | Medium | 5.8 | 2026-09-15 | AVideo through 29.0 contains an unauthenticated server-side request forgery vulnerability in the check_site_availability function that accepts attacker-control… |
CVE-2026-91965 | High | 7.5 | 2026-09-15 | WWBN AVideo through 29.0 fails to enforce user-group restrictions in the plugin/Live/stats.json.php and plugin/Live/calendar.json.php endpoints. Unauthenticate… |
CVE-2026-90552 | Medium | 4.3 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate playlist ownership in the Playlists_schedules/list.json.php and Live/cale… |
CVE-2026-90551 | Medium | 5.3 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate playlist ownership in the video_from_program API endpoint, allowing unaut… |
CVE-2026-90550 | Medium | 5.3 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to check user authorization in the PlayerSkins mediaSession.json.php endpoint before… |
CVE-2026-90549 | Medium | 5.3 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to properly authorize access to the videosAndroid.json.php endpoint, allowing unauthe… |
CVE-2026-90548 | Medium | 5.3 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate user permissions in the ImageGallery list.json.php endpoint, allowing una… |
CVE-2026-90547 | Medium | 5.3 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate user permissions in the Bookmark plugin getBookmarks.json.php endpoint, a… |
CVE-2026-90546 | Medium | 4.3 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the like.json.php endpoint, allowing logged-i… |
CVE-2026-90545 | Medium | 4.3 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the commentAddNew.json.php endpoint, allowing… |
CVE-2026-90544 | Medium | 4.3 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the videoAddViewCount.json.php endpoint befor… |
CVE-2026-90543 | Medium | 5.3 | 2026-09-12 | WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier, with the Live plugin enabled, contains a missing authentication vulnerability in pl… |
CVE-2026-90542 | Medium | 5.4 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate that logged-in users can access live schedules before creating reminders… |
CVE-2026-90541 | Medium | 5.3 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to require authentication in the plugin/TopMenu/menus.json.php endpoint, allowing una… |
CVE-2026-90540 | Medium | 4.3 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate watch permissions in the playListAddVideo.json.php endpoint when adding v… |
CVE-2026-90539 | Medium | 5.3 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authentication vulnerability in the plugin/TopMenu/menuItems.json.php en… |
CVE-2026-90538 | Medium | 5.3 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in playlistsFromUser.json.php that allows un… |
CVE-2026-90537 | High | 8.2 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/Scheduler/sendEmail.json.php that… |
CVE-2026-90536 | Medium | 5.3 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to authorize access to the adsInfo API endpoint, allowing unauthenticated attackers t… |
CVE-2026-89257 | Medium | 5.4 | 2026-09-11 | AVideo through 29.0 contains an insecure direct object reference (IDOR) vulnerability in objects/categoryDeleteAssets.json.php. The endpoint validates only the… |
CVE-2026-89256 | High | 8.7 | 2026-09-11 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the Bookmark plugin where chapter names… |
CVE-2026-89255 | High | 8.7 | 2026-09-11 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to HT… |
CVE-2026-89254 | High | 8.7 | 2026-09-11 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the CustomizeUser plugin where the field… |
CVE-2026-89253 | High | 8.7 | 2026-09-11 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the user 'donationLink' profile fie… |
CVE-2026-89252 | Medium | 6.5 | 2026-09-11 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify ownership in addLiveLink.php when updating LiveLinks, allowing authenticated use… |
CVE-2026-89251 | Medium | 6.5 | 2026-09-11 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ad impressions in plugin/AD_Server/log.php, allowing logged-in users to submit… |
CVE-2026-89250 | High | 7.5 | 2026-09-11 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an unauthenticated file read vulnerability in the getRecordedFile.php endpoint tha… |
CVE-2026-89249 | High | 8.7 | 2026-09-11 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the YPTWallet plugin where user-supplied… |
CVE-2026-89248 | Medium | 5.3 | 2026-09-11 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is missing an authentication/authorization check in plugin/WebRTC/status.json.php. When the WebR… |
CVE-2026-89247 | Medium | 6.1 | 2026-09-11 | WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier contains an XML injection vulnerability in plugin/AD_Server/VMAP.php, which is reach… |
CVE-2026-89246 | Medium | 5.4 | 2026-09-11 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a CSV formula injection vulnerability in the myComments.download.php endpoint that… |
CVE-2026-89245 | Medium | 6.5 | 2026-09-11 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in playlistRemove.php that allows attac… |
CVE-2026-89244 | Medium | 6.1 | 2026-09-11 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Gallery/view/Category.php… |
CVE-2026-89243 | High | 8.1 | 2026-09-11 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in UserGroups::setGroup_name() that fa… |
CVE-2026-89242 | High | 7.2 | 2026-09-11 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a server-side request forgery vulnerability in the _json_decode function that fetc… |
CVE-2026-89241 | Medium | 6.1 | 2026-09-11 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in confirmLivePassword.php that cop… |
CVE-2026-89240 | Medium | 6.1 | 2026-09-11 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Live/confirmLivePassword… |
CVE-2026-89239 | Medium | 6.1 | 2026-09-11 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in the showAlertMessage() function… |
CVE-2026-89148 | Medium | 5.4 | 2026-09-11 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an open redirect in objects/playlistSort.php. Because the endpoint is not a *.json.php… |
CVE-2026-88876 | High | 7.5 | 2026-09-10 | AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/PlayerSkins/seo.php that allows unaut… |
CVE-2026-88875 | Medium | 4.3 | 2026-09-10 | AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) incompletely sanitizes sensitive user fields in the APIName=video respons… |
CVE-2026-88874 | High | 7.5 | 2026-09-10 | AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) does not enforce the Live stream password check on the stats endpoint or… |
CVE-2026-88873 | High | 7.1 | 2026-09-10 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in view/logArchive.json.php that allows… |
CVE-2026-88872 | High | 7.1 | 2026-09-10 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in the setPassword.json.php endpoint that al… |
CVE-2026-88871 | Medium | 4.3 | 2026-09-10 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) contains a cross-site request forgery vulnerability in the CustomizeUs… |
CVE-2026-88870 | High | 7.1 | 2026-09-10 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in the LoginControl plugin PGP key endp… |
CVE-2026-88869 | Critical | 9.3 | 2026-09-10 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the AD_Server plugin's log.php endpoint… |
CVE-2026-88868 | High | 8.7 | 2026-09-10 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LiveLinks plugin where title and des… |
CVE-2026-88867 | High | 8.7 | 2026-09-10 | WWBN AVideo, in versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1, contains a stored cross-site scripting vulnerability. objects/cat… |
CVE-2026-88866 | High | 8.7 | 2026-09-10 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails… |
CVE-2026-88865 | High | 8.1 | 2026-09-10 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate restream ownership in getRestream.json.php, allowing authenticated users with… |
CVE-2026-86729 | High | 7.4 | 2026-09-08 | WWBN AVideo through commit e01e41ecc (no patched version available) exposes get_api_preauthorize in plugin/API/API.php as a second, undocumented login path. Un… |
CVE-2026-86728 | High | 7.5 | 2026-09-08 | AVideo through 29.0 contains an authentication bypass vulnerability in plugin/PlayLists/epg.json.php that exposes live-stream keys and private EPG schedules to… |
CVE-2026-86727 | High | 7.5 | 2026-09-08 | AVideo through 29.0 contains an information disclosure vulnerability in plugin/Live/stats.json.php that allows unauthenticated attackers to retrieve stream key… |
CVE-2026-86726 | Medium | 6.5 | 2026-09-08 | AVideo through 29.0 contains an information disclosure vulnerability in restreamsActive.json.php that allows authenticated streamers to enumerate source stream… |
CVE-2026-86725 | High | 7.1 | 2026-09-08 | AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in the SocialMediaPublisher plugin's add.json.php endpoi… |
CVE-2026-86724 | Medium | 6.5 | 2026-09-08 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in plugin/YPTWallet/view/saveBalance.php tha… |
CVE-2026-86723 | High | 8.1 | 2026-09-08 | AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability in LoginControl::verifyChallenge() that uses loose comp… |
CVE-2026-86722 | High | 8.1 | 2026-09-08 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability where sqlDAL caches empty result sets that write… |
CVE-2026-86721 | High | 7.5 | 2026-09-08 | AVideo through commit c3edcc274c contains an authorization bypass vulnerability where a session cookie named 'key' with value 'value' overrides the $_REQUEST['… |
CVE-2026-86720 | High | 8.1 | 2026-09-08 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ownership of live_restreams_id in resendRestreamer.json.php, allowing aut… |
CVE-2026-86719 | Medium | 5.4 | 2026-09-08 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master) contains a cross-site request forgery vulnerability in the CustomizeUser plugin en… |
CVE-2026-86718 | High | 7.1 | 2026-09-08 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in deleteHistory.json.php and finishAll… |
CVE-2026-86190 | Critical | 9.1 | 2026-09-05 | WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery t… |
CVE-2026-86189 | Critical | 9.8 | 2026-09-05 | WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by su… |
CVE-2026-86188 | High | 7.2 | 2026-09-05 | AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other… |
CVE-2026-86187 | Medium | 5.9 | 2026-09-05 | WWBN AVideo generates passwords for external-login accounts using rand() instead of a cryptographic generator, producing only 31-bit integers. Attackers with a… |
CVE-2026-86186 | Medium | 6.5 | 2026-09-05 | AVideo API fails to enforce rate limits when clients send a bot User-Agent header, allowing attackers to bypass all eight protected operations including login… |
CVE-2026-85577 | Medium | 5.4 | 2026-09-04 | AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php that allows unauthenticated attackers to inject arbitr… |
CVE-2026-85164 | High | 7.1 | 2026-09-03 | WWBN AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the set_api_userImages API endpoint that fails to validate profile… |
CVE-2026-85163 | Medium | 6.5 | 2026-09-03 | AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the EPG parser that allows authenticated uploaders to fetch arbitrary i… |
CVE-2026-85162 | Medium | 6.5 | 2026-09-03 | AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in plugin/Live/saveLive.php that lacks forbidIfNotPost and forbidIfInvalidT… |
CVE-2026-85161 | Medium | 4.3 | 2026-09-03 | AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in removePoster.php that lacks forbidIfNotPost or forbidIfInvalidToken chec… |
CVE-2026-85160 | High | 8.1 | 2026-09-03 | AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php that allows attackers to delete director… |
CVE-2026-85159 | Medium | 5.4 | 2026-09-03 | AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php where the cancelUri parameter is echoed in an href att… |
CVE-2026-85158 | Medium | 5.4 | 2026-09-03 | AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in videoEmbeded.php that echoes the link parameter inside an HTML comme… |
CVE-2026-85157 | Medium | 5.3 | 2026-09-03 | WWBN AVideo contains a broken access control vulnerability in the unauthenticated feed/index.php endpoint that disables per-video visibility checks when a prog… |
CVE-2026-85156 | Medium | 5.3 | 2026-09-03 | WWBN AVideo fails to properly validate access controls on the public channel page, allowing unauthenticated visitors to view unlisted and group-restricted vide… |
CVE-2026-85155 | High | 7.5 | 2026-09-03 | WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php endpoint with APIName=channels that allows unauthenticated… |
CVE-2026-85154 | Critical | 9.8 | 2026-09-03 | WWBN AVideo contains an authentication failure vulnerability where the video_id_hash credential is a non-expiring, non-revocable bearer token that grants full… |
CVE-2026-84483 | Medium | 5.3 | 2026-09-01 | WWBN AVideo through commit 9c39d8c8 contains an incomplete authentication bypass in encryptPass.json.php that allows unauthenticated attackers to compute valid… |
CVE-2026-84482 | High | 8.8 | 2026-09-01 | WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the get_domain() and isSameDomain() functions that fail to properly… |
CVE-2026-84481 | | | 2026-09-01 | WWBN AVideo through 30.0 contains an information disclosure vulnerability in the MobileManager plugin getConfiguration endpoint that returns sensitive configur… |
CVE-2026-84480 | Critical | 9.8 | 2026-09-01 | WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account pas… |