Advisories · Technology
WWBN AVideo.
Every CVE that names WWBN AVideo among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.9 Medium
WWBN AVideo before 29.5.0 Local PHP File Inclusion via Accept-Language Header
- WWBN AVideo
- Path traversal
- CVSS 5.1 Medium
WWBN AVideo 26.0 through 29.3.0 Stored XSS via Comment Markdown Rendering
- WWBN AVideo
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
WWBN AVideo before 29.4.0 Blind SSRF via getHeaderContentTypeFromURL Redirect
- WWBN AVideo
- Server-side request forgery (SSRF)
- CVSS 7.0 High
WWBN AVideo before 29.4.0 Incorrect Authorization via confirmDeleteUser.json.php
- WWBN AVideo
- Broken access control
- CVSS 5.1 Medium
WWBN AVideo before 24.0 CSRF via Legacy Playlist and Video Endpoints
- WWBN AVideo
- Cross-site request forgery (CSRF)
- CVSS 9.3 CriticalCritical · CVSS 9+
WWBN AVideo 12.4 through 29.2.0 Stored XSS via Double-Encoded Video Title
- WWBN AVideo
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
WWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHPFlix2 Templates
- WWBN AVideo
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
AVideo before 29.1.0 Stored XSS via HTML Entity Bypass in trailer1 Field
- WWBN AVideo
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
WWBN AVideo userVerifyEmail.php Unauthenticated Access Control
- WWBN AVideo
- Denial of service
- CVSS 8.6 High
AVideo LoginControl PGP Second Factor Authentication Bypass
- WWBN AVideo
- Authentication bypass
- CVSS 9.1 CriticalCritical · CVSS 9+
AVideo Weak PRNG Activation Code Authentication Bypass
- WWBN AVideo
- Weak cryptography or TLS
- CVSS 8.3 High
AVideo Cryptographically Weak PRNG via uniqid Stream Key
- WWBN AVideo
- Weak cryptography or TLS
- CVSS 5.3 Medium
AVideo through 29.0 Missing Authorization via comment API endpoint
- WWBN AVideo
- Broken access control
- CVSS 5.3 Medium
AVideo through 29.0 Missing Authorization Check via API Like Endpoint
- WWBN AVideo
- Broken access control
- CVSS 5.3 Medium
AVideo through 29.0 Stored Cross-Site Scripting via User-Agent Header
- WWBN AVideo
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
AVideo through 29.0 Rate Limit Bypass via Non-Atomic Counter Increment
- WWBN AVideo
- Authentication bypass
- CVSS 7.1 High
AVideo through 29.0 Broken Access Control via videoAddNew.json.php CSRF Bypass
- WWBN AVideo
- Cross-site request forgery (CSRF)
- CVSS 5.3 Medium
AVideo through 29.0 Like Counter Desynchronization via Array Parameter
- WWBN AVideo
- CWE-20
- CVSS 8.7 High
AVideo through 29.0 CloneSite Stored Shell Injection via SSH Password CSRF
- WWBN AVideo
- Command injection
- CVSS 5.3 Medium
AVideo through 29.0 Broken Access Control via CSRF Exemption Basename Collision
- WWBN AVideo
- CWE-289
- CVSS 9.2 CriticalCritical · CVSS 9+
WWBN AVideo through 29.0 Authentication Bypass via Stored Password Hash
- WWBN AVideo
- Authentication bypass
- CVSS 8.7 High
AVideo through 29.0 API get_api_video Broken Access Control via clean_title
- WWBN AVideo
- Broken access control
- CVSS 5.3 Medium
AVideo through 29.0 Blind SSRF via getHeaderContentTypeFromURL
- WWBN AVideo
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
AVideo through 29.0 Unauthenticated SSRF via Host Header
- WWBN AVideo
- Server-side request forgery (SSRF)
- CVSS 8.7 High
WWBN AVideo through 29.0 Broken Access Control via Live Endpoints
- WWBN AVideo
- Information disclosure
- CVSS 5.3 Medium
WWBN AVideo Missing Authorization via Playlists_schedules list.json.php
- WWBN AVideo
- Broken access control
- CVSS 6.9 Medium
WWBN AVideo Missing Authorization via video_from_program API
- WWBN AVideo
- Broken access control
- CVSS 6.9 Medium
WWBN AVideo Missing Authorization via mediaSession.json.php
- WWBN AVideo
- Information disclosure
- CVSS 6.9 Medium
WWBN AVideo Missing Authorization via videosAndroid.json.php Endpoint
- WWBN AVideo
- Information disclosure
- CVSS 6.9 Medium
WWBN AVideo Missing Authorization in ImageGallery list.json.php
- WWBN AVideo
- Information disclosure
- CVSS 6.9 Medium
WWBN AVideo Missing Authorization via getBookmarks.json.php
- WWBN AVideo
- Broken access control
- CVSS 5.3 Medium
WWBN AVideo Missing Authorization via like.json.php
- WWBN AVideo
- Broken access control
- CVSS 5.3 Medium
WWBN AVideo Missing Authorization via commentAddNew.json.php
- WWBN AVideo
- Broken access control
- CVSS 5.3 Medium
WWBN AVideo Missing Authorization via videoAddViewCount.json.php
- WWBN AVideo
- Broken access control
- CVSS 6.9 Medium
WWBN AVideo Missing Authentication via socketMessageLiveOwner.json.php
- WWBN AVideo
- Authentication bypass
- CVSS 5.3 Medium
WWBN AVideo Missing Authorization via remindMe.json.php
- WWBN AVideo
- Broken access control
- CVSS 6.9 Medium
WWBN AVideo Unauthenticated Information Disclosure via menus.json.php
- WWBN AVideo
- Information disclosure
- CVSS 5.3 Medium
WWBN AVideo Missing Authorization via playListAddVideo.json.php
- WWBN AVideo
- Broken access control
- CVSS 6.9 Medium
WWBN AVideo Missing Authentication via menuItems.json.php
- WWBN AVideo
- Information disclosure
- CVSS 6.9 Medium
WWBN AVideo Missing Authorization via playlistsFromUser.json.php
- WWBN AVideo
- Information disclosure
- CVSS 8.8 High
WWBN AVideo Scheduler sendEmail Missing Authorization via Token
- WWBN AVideo
- Broken access control
- CVSS 6.9 Medium
WWBN AVideo Missing Authorization via adsInfo API Endpoint
- WWBN AVideo
- Information disclosure
- CVSS 5.3 Medium
AVideo through 29.0 Cross-User Category Asset Deletion via Missing Ownership Check
- WWBN AVideo
- Broken access control
- CVSS 9.3 CriticalCritical · CVSS 9+
AVideo Bookmark Plugin Stored XSS via Chapter Names
- WWBN AVideo
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
AVideo LoginControl Stored XSS via PGP Public Key
- WWBN AVideo
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
AVideo CustomizeUser Stored XSS via field_name Parameter
- WWBN AVideo
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
AVideo Stored XSS via donationLink in watch page button
- WWBN AVideo
- Cross-site scripting (XSS)
- CVSS 7.1 High
AVideo Missing Authorization in addLiveLink.php LiveLink Update
- WWBN AVideo
- Broken access control
- CVSS 7.1 High
AVideo Missing Authorization via AD_Server log.php Wallet Credit
- WWBN AVideo
- CWE-345
- CVSS 8.7 High
WWBN AVideo Unauthenticated File Read via getRecordedFile.php
- WWBN AVideo
- Authentication bypass
- CVSS 9.3 CriticalCritical · CVSS 9+
AVideo YPTWallet Stored XSS via CryptoWallet Configuration
- WWBN AVideo
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
AVideo WebRTC Plugin Information Disclosure via status.json.php
- WWBN AVideo
- Information disclosure
- CVSS 5.3 Medium
WWBN AVideo XML Injection via plugin/AD_Server/VMAP.php
- WWBN AVideo
- Other injection
- CVSS 5.1 Medium
WWBN AVideo CSV Formula Injection via myComments.download.php
- WWBN AVideo
- Other injection
- CVSS 7.1 High
WWBN AVideo Cross-Site Request Forgery via playlistRemove.php
- WWBN AVideo
- Cross-site request forgery (CSRF)
- CVSS 5.3 Medium
WWBN AVideo Reflected XSS via Gallery Category getBackURL
- WWBN AVideo
- Cross-site scripting (XSS)
- CVSS 9.2 CriticalCritical · CVSS 9+
WWBN AVideo Stored XSS via UserGroups setGroup_name
- WWBN AVideo
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
WWBN AVideo Unauthenticated SSRF via login.json.php
- WWBN AVideo
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
WWBN AVideo Reflected XSS via confirmLivePassword.php
- WWBN AVideo
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
WWBN AVideo Reflected XSS via confirmLivePassword.php
- WWBN AVideo
- Cross-site scripting (XSS)