Wwbn
Page 3 of 4 — Wwbn CVEs from a corpus of 344, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-34611 | Medium | 6.5 | 2026-03-31 | WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo endpoint objects/emailAllUsers.json.php allows administrators to send HTML… |
CVE-2026-34396 | Medium | 6.1 | 2026-03-31 | WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo admin panel renders plugin configuration values in HTML forms without appl… |
CVE-2026-34395 | Medium | 6.5 | 2026-03-31 | WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/YPTWallet/view/users.json.php endpoint returns all platform users with the… |
CVE-2026-34394 | High | 8.1 | 2026-03-31 | WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's admin plugin configuration endpoint (admin/save.json.php) lacks any CSRF tok… |
CVE-2026-34375 | High | 8.2 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the YPTWallet Stripe payment confirmation page directly echoes the `$_REQUE… |
CVE-2026-34374 | Critical | 9.1 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `Live_schedule::keyExists()` method constructs a SQL query by interpola… |
CVE-2026-34369 | Medium | 5.3 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `get_api_video_file` and `get_api_video` API endpoints in AVideo return… |
CVE-2026-34368 | Medium | 5.3 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `transferBalance()` method in `plugin/YPTWallet/YPTWallet.php` contains… |
CVE-2026-34364 | Medium | 5.3 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `categories.json.php` endpoint, which serves the category listing API… |
CVE-2026-34362 | Medium | 5.4 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `verifyTokenSocket()` function in `plugin/YPTSocket/functions.php` has… |
CVE-2026-34247 | Medium | 5.4 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `plugin/Live/uploadPoster.php` endpoint allows any authenticated user t… |
CVE-2026-34245 | Medium | 6.3 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `plugin/PlayLists/View/Playlists_schedules/add.json.php` endpoint allow… |
CVE-2026-33867 | High | 7.5 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, AVideo allows content owners to password-protect individual videos. The vid… |
CVE-2026-33770 | Critical | 9.8 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `fixCleanTitle()` static method in `objects/category.php` constructs a… |
CVE-2026-33767 | High | 8.8 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, in `objects/like.php`, the `getLike()` method constructs a SQL query using… |
CVE-2026-33766 | Medium | 6.5 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, `isSSRFSafeURL()` validates URLs against private/reserved IP ranges before… |
CVE-2026-33764 | Medium | 4.3 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the AI plugin's `save.json.php` endpoint loads AI response objects using an… |
CVE-2026-33763 | Medium | 5.3 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `get_api_video_password_is_correct` API endpoint allows any unauthentic… |
CVE-2026-33761 | Medium | 5.3 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, three `list.json.php` endpoints in the Scheduler plugin lack any authentica… |
CVE-2026-33759 | Medium | 5.3 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/playlistsVideos.json.php` endpoint returns the full video cont… |
CVE-2026-33723 | High | 7.1 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `Subscribe::save()` method in `objects/subscribe.php` concatenates the… |
CVE-2026-33719 | High | 8.6 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the CDN plugin endpoints `plugin/CDN/status.json.php` and `plugin/CDN/disab… |
CVE-2026-33717 | High | 8.8 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `downloadVideoFromDownloadURL()` function in `objects/aVideoEncoder.jso… |
CVE-2026-33716 | Critical | 9.4 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the standalone live stream control endpoint at `plugin/Live/standAloneFiles… |
CVE-2026-33690 | Medium | 5.3 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `getRealIpAddr()` function in `objects/functions.php` trusts user-contr… |
CVE-2026-33688 | Medium | 5.3 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the password recovery endpoint at `objects/userRecoverPass.php` performs us… |
CVE-2026-33685 | Medium | 5.3 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `plugin/AD_Server/reports.json.php` endpoint performs no authentication… |
CVE-2026-33683 | Medium | 5.4 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, a sanitization order-of-operations flaw in the user profile "about" field a… |
CVE-2026-33681 | High | 7.2 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/pluginRunDatabaseScript.json.php` endpoint accepts a `name` pa… |
CVE-2026-33651 | High | 8.1 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `remindMe.json.php` endpoint passes `$_REQUEST['live_schedule_id']` thr… |
CVE-2026-33650 | High | 7.6 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, a user with the "Videos Moderator" permission can escalate privileges to pe… |
CVE-2026-33649 | High | 8.1 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `plugin/Permissions/setPermission.json.php` endpoint accepts GET parame… |
CVE-2026-33648 | High | 8.8 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the restreamer endpoint constructs a log file path by embedding user-contro… |
CVE-2026-33647 | High | 8.8 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `ImageGallery::saveFile()` method validates uploaded file content using… |
CVE-2026-33513 | High | 8.6 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, an unauthenticated API endpoint (`APIName=locale`) concatenates user input… |
CVE-2026-33512 | High | 7.5 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the API plugin exposes a `decryptString` action without any authentication… |
CVE-2026-33507 | High | 8.8 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/pluginImport.json.php` endpoint allows admin users to upload a… |
CVE-2026-33502 | Critical | 9.3 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, an unauthenticated server-side request forgery vulnerability in `plugin/Liv… |
CVE-2026-33501 | Medium | 5.3 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the endpoint `plugin/Permissions/View/Users_groups_permissions/list.json.ph… |
CVE-2026-33500 | Medium | 5.4 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the fix for CVE-2026-27568 (GHSA-rcqw-6466-3mv7) introduced a custom `Parse… |
CVE-2026-33499 | Medium | 6.1 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `view/forbiddenPage.php` and `view/warningPage.php` templates reflect t… |
CVE-2026-33493 | High | 7.1 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/import.json.php` endpoint accepts a user-controlled `fileURI`… |
CVE-2026-33492 | High | 7.3 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, AVideo's `_session_start()` function accepts arbitrary session IDs via the… |
CVE-2026-33488 | High | 7.4 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `createKeys()` function in the LoginControl plugin's PGP 2FA system gen… |
CVE-2026-33485 | High | 7.5 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the RTMP `on_publish` callback at `plugin/Live/on_publish.php` is accessibl… |
CVE-2026-33483 | High | 7.5 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `aVideoEncoderChunk.json.php` endpoint is a completely standalone PHP s… |
CVE-2026-33482 | High | 8.1 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `sanitizeFFmpegCommand()` function in `plugin/API/standAlone/functions… |
CVE-2026-33480 | High | 8.6 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `isSSRFSafeURL()` function in AVideo can be bypassed using IPv4-mapped… |
CVE-2026-33479 | High | 8.8 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the Gallery plugin's `saveSort.json.php` endpoint passes unsanitized user i… |
CVE-2026-33478 | Critical | 10.0 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, multiple vulnerabilities in AVideo's CloneSite plugin chain together to all… |
CVE-2026-33354 | High | 7.6 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, `POST /objects/aVideoEncoder.json.php` accepts a requester-controlled `chun… |
CVE-2026-33352 | Critical | 9.8 | 2026-03-23 | WWBN AVideo is an open source video platform. Prior to version 26.0, an unauthenticated SQL injection vulnerability exists in `objects/category.php` in the `ge… |
CVE-2026-33351 | Critical | 9.1 | 2026-03-23 | WWBN AVideo is an open source video platform. Prior to version 26.0, a Server-Side Request Forgery (SSRF) vulnerability exists in `plugin/Live/standAloneFiles/… |
CVE-2026-33297 | Critical | 9.1 | 2026-03-23 | WWBN AVideo is an open source video platform. Prior to version 26.0, the `setPassword.json.php` endpoint in the CustomizeUser plugin allows administrators to s… |
CVE-2026-33319 | Medium | 5.9 | 2026-03-22 | WWBN AVideo is an open source video platform. Prior to version 26.0, the `uploadVideoToLinkedIn()` method in the SocialMediaPublisher plugin constructs a shell… |
CVE-2026-33296 | Medium | 6.1 | 2026-03-22 | WWBN AVideo is an open source video platform. Prior to version 26.0, WWBN/AVideo contains an open redirect vulnerability in the login flow where a user-supplie… |
CVE-2026-33295 | Medium | 5.4 | 2026-03-22 | WWBN AVideo is an open source video platform. Prior to version 26.0, WWBN/AVideo contains a stored cross-site scripting vulnerability in the CDN plugin's downl… |
CVE-2026-33294 | Medium | 5.0 | 2026-03-22 | WWBN AVideo is an open source video platform. Prior to version 26.0, the BulkEmbed plugin's save endpoint (`plugin/BulkEmbed/save.json.php`) fetches user-suppl… |
CVE-2026-33293 | High | 8.1 | 2026-03-22 | WWBN AVideo is an open source video platform. Prior to version 26.0, the `deleteDump` parameter in `plugin/CloneSite/cloneServer.json.php` is passed directly t… |
CVE-2026-33292 | High | 7.5 | 2026-03-22 | WWBN AVideo is an open source video platform. Prior to version 26.0, the HLS streaming endpoint (`view/hls.php`) is vulnerable to a path traversal attack that… |
CVE-2026-33238 | Medium | 4.3 | 2026-03-21 | WWBN AVideo is an open source video platform. Prior to version 26.0, the `listFiles.json.php` endpoint accepts a `path` POST parameter and passes it directly t… |
CVE-2026-33237 | Medium | 5.5 | 2026-03-21 | WWBN AVideo is an open source video platform. Prior to version 26.0, the Scheduler plugin's `run()` function in `plugin/Scheduler/Scheduler.php` calls `url_get… |
CVE-2026-33043 | High | 8.1 | 2026-03-20 | WWBN AVideo is an open source video platform. In versions 25.0 and below, /objects/phpsessionid.json.php exposes the current PHP session ID to any unauthentica… |
CVE-2026-33041 | Medium | 5.3 | 2026-03-20 | WWBN AVideo is an open source video platform. In versions 25.0 and below, /objects/encryptPass.json.php exposes the application's password hashing algorithm to… |
CVE-2026-33039 | High | 8.6 | 2026-03-20 | WWBN AVideo is an open source video platform. In versions 25.0 and below, the plugin/LiveLinks/proxy.php endpoint validates user-supplied URLs against internal… |
CVE-2026-33038 | High | 8.1 | 2026-03-20 | WWBN AVideo is an open source video platform. Versions 25.0 and below are vulnerable to unauthenticated application takeover through the install/checkConfigura… |
CVE-2026-33037 | High | 8.1 | 2026-03-20 | WWBN AVideo is an open source video platform. In versions 25.0 and below, the official Docker deployment files (docker-compose.yml, env.example) ship with the… |
CVE-2026-33035 | Medium | 6.1 | 2026-03-20 | WWBN AVideo is an open source video platform. In versions 25.0 and below, there is a reflected XSS vulnerability that allows unauthenticated attackers to execu… |
CVE-2026-33025 | High | 8.8 | 2026-03-20 | AVideo is a video-sharing Platform. Versions prior to 8.0 contain a SQL Injection vulnerability in the getSqlFromPost() method of Object.php. The $_POST['sort'… |
CVE-2026-33024 | Critical | 9.1 | 2026-03-20 | AVideo is a video-sharing Platform. Versions prior to 8.0 contain a Server-Side Request Forgery vulnerability (CWE-918) in the public thumbnail endpoints getIm… |
CVE-2026-30885 | Medium | 5.3 | 2026-03-10 | WWBN AVideo is an open source video platform. Prior to 25.0, the /objects/playlistsFromUser.json.php endpoint returns all playlists for any user without requir… |
CVE-2026-29058 | Critical | 9.8 | 2026-03-06 | AVideo is a video-sharing Platform software. Prior to version 7.0, an unauthenticated attacker can execute arbitrary OS commands on the server by injecting she… |
CVE-2026-29093 | High | 8.1 | 2026-03-06 | WWBN AVideo is an open source video platform. Prior to version 24.0, the official docker-compose.yml publishes the memcached service on host port 11211 (0.0.0… |
CVE-2026-28502 | High | 8.8 | 2026-03-06 | WWBN AVideo is an open source video platform. Prior to version 24.0, an authenticated Remote Code Execution (RCE) vulnerability was identified in AVideo relate… |
CVE-2026-28501 | Critical | 9.8 | 2026-03-06 | WWBN AVideo is an open source video platform. Prior to version 24.0, an unauthenticated SQL Injection vulnerability exists in AVideo within the objects/videos… |
CVE-2026-27732 | High | 8.1 | 2026-02-24 | WWBN AVideo is an open source video platform. Prior to version 22.0, the `aVideoEncoder.json.php` API endpoint accepts a `downloadURL` parameter and fetches th… |
CVE-2026-27568 | Medium | 6.1 | 2026-02-24 | WWBN AVideo is an open source video platform. Prior to version 21.0, AVideo allows Markdown in video comments and uses Parsedown (v1.7.4) without Safe Mode ena… |
CVE-2020-37173 | High | 7.5 | 2026-02-11 | AVideo Platform 8.1 contains an information disclosure vulnerability that allows attackers to enumerate user details through the playlistsFromUser.json.php end… |
CVE-2020-37172 | Medium | 5.3 | 2026-02-11 | AVideo Platform 8.1 contains a cross-site request forgery vulnerability that allows attackers to reset user passwords by exploiting the password recovery mecha… |
CVE-2020-37158 | Medium | 5.3 | 2026-02-11 | AVideo Platform 8.1 contains a cross-site request forgery vulnerability that allows attackers to reset user passwords by exploiting the password recovery mecha… |
CVE-2025-34442 | High | 7.5 | 2025-12-17 | AVideo versions prior to 20.1 disclose absolute filesystem paths via multiple public API endpoints. Returned metadata includes full server paths to media files… |
CVE-2025-34441 | High | 7.5 | 2025-12-17 | AVideo versions prior to 20.1 expose sensitive user information through an unauthenticated public API endpoint. Responses include emails, usernames, administra… |
CVE-2025-34440 | Medium | 6.1 | 2025-12-17 | AVideo versions prior to 20.1 contain an open redirect vulnerability caused by insufficient validation of the siteRedirectUri parameter during user registratio… |
CVE-2025-34439 | Medium | 6.1 | 2025-12-17 | AVideo versions prior to 20.1 are vulnerable to an open redirect flaw due to missing validation of the cancelUri parameter during user login. An attacker can c… |
CVE-2025-34438 | High | 8.1 | 2025-12-17 | AVideo versions prior to 20.1 contain an insecure direct object reference vulnerability allowing users with upload permissions to modify the rotation metadata… |
CVE-2025-34437 | High | 8.8 | 2025-12-17 | AVideo versions prior to 20.1 permit any authenticated user to upload comment images to videos owned by other users. The endpoint validates authentication but… |
CVE-2025-34436 | High | 8.8 | 2025-12-17 | AVideo versions prior to 20.1 allow any authenticated user to upload files into directories belonging to other users due to an insecure direct object reference… |
CVE-2025-34435 | Medium | 6.5 | 2025-12-17 | AVideo versions prior to 20.1 are vulnerable to an insecure direct object reference (IDOR) that allows any authenticated user to delete media files belonging t… |
CVE-2025-34434 | Critical | 9.1 | 2025-12-17 | AVideo versions prior to 20.1 with the ImageGallery plugin enabled is vulnerable to unauthenticated file upload and deletion. Plugin endpoints responsible for… |
CVE-2025-53084 | Critical | 9.0 | 2025-07-24 | A cross-site scripting (xss) vulnerability exists in the videosList page parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A speciall… |
CVE-2025-50128 | Critical | 9.6 | 2025-07-24 | A cross-site scripting (xss) vulnerability exists in the videoNotFound 404ErrorMsg parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff… |
CVE-2025-48732 | High | 7.3 | 2025-07-24 | An incomplete blacklist exists in the .htaccess sample of WWBN AVideo 14.4 and dev master commit 8a8954ff. A specially crafted HTTP request can lead to a arbit… |
CVE-2025-46410 | Critical | 9.6 | 2025-07-24 | A cross-site scripting (xss) vulnerability exists in the managerPlaylists PlaylistOwnerUsersId parameter functionality of WWBN AVideo 14.4 and dev master commi… |
CVE-2025-41420 | Critical | 9.6 | 2025-07-24 | A cross-site scripting (xss) vulnerability exists in the userLogin cancelUri parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A spec… |
CVE-2025-36548 | High | 8.3 | 2025-07-24 | A cross-site scripting (xss) vulnerability exists in the LoginWordPress loginForm cancelUri parameter functionality of WWBN AVideo 14.4 and dev master commit 8… |
CVE-2025-25214 | High | 8.8 | 2025-07-24 | A race condition vulnerability exists in the aVideoEncoder.json.php unzip functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A series of special… |
CVE-2024-34899 | Medium | 5.4 | 2024-05-14 | WWBN AVideo 12.4 is vulnerable to Cross Site Scripting (XSS). |
CVE-2024-31819 | Critical | 9.8 | 2024-04-10 | An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath parameter of the submitIndex.php compon… |
CVE-2023-50172 | Medium | 5.3 | 2024-01-10 | A recovery notification bypass vulnerability exists in the userRecoverPass.php captcha validation functionality of WWBN AVideo dev master commit 15fed957fb. A… |
CVE-2023-49864 | Medium | 6.5 | 2024-01-10 | An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb… |