Wwbn
Monthly
WWBN AVideo versions up to and including 26.0 contain an unauthenticated API endpoint that allows arbitrary decryption of ciphertext. Attackers can exploit the decryptString action in the API plugin without authentication to decrypt publicly-issued ciphertext (such as from view/url2Embed.json.php), allowing recovery of protected tokens and metadata. The CVSS score of 7.5 reflects high confidentiality impact with network accessibility and no authentication required.
WWBN AVideo open source video platform versions 25.0 and below ship with a hardcoded default administrator password ('password') in official Docker deployment files that is automatically used during installation without any forced change mechanism. Attackers can gain immediate administrative access to unpatched instances, enabling user data exposure, content manipulation, and potential remote code execution via file upload and plugin management features. The issue is compounded by weak MD5 password hashing and similarly insecure default database credentials (avideo/avideo).
Unauthenticated SQL injection in AVideo versions before 8.0 allows authenticated attackers to manipulate database queries through unsanitized sort parameters in POST requests, potentially leading to unauthorized data access or modification. The vulnerability stems from improper use of real_escape_string() on SQL identifiers rather than string literals, rendering the escaping mechanism ineffective. Affected organizations should upgrade to version 8.0 or implement WAF rules restricting sort parameter characters to alphanumeric and underscore values.
AVideo, a video-sharing platform, contains a Server-Side Request Forgery (SSRF) vulnerability in versions prior to 8.0 affecting the public thumbnail endpoints getImage.php and getImageMP4.php. Unauthenticated attackers can exploit insufficient URL validation to force the server to make requests to internal network resources including cloud metadata endpoints (AWS EC2 169.254.169.254), localhost, and private IP ranges. The vulnerability has a CVSS 4.0 score of 9.3 with network attack vector requiring no privileges or user interaction, though there is no evidence of active exploitation or public proof-of-concept at this time.
Unauthenticated OS command injection in AVideo before 7.0.
Memcached session storage exposure in AVideo prior to version 24.0 allows unauthenticated remote attackers to read, modify, or delete user sessions by accessing the publicly exposed memcached service on port 11211. An attacker with network access to this port can hijack admin accounts, impersonate users, or destroy all active sessions without any authentication. This affects the official Docker deployment configuration for PHP, Docker, and AVideo products.
Unauthenticated administrators in WWBN AVideo versions before 24.0 can achieve remote code execution by uploading malicious ZIP files through the plugin upload functionality, which extracts files without proper validation into web-accessible directories. This allows attackers to execute arbitrary PHP code on the server with high impact to confidentiality, integrity, and availability. No patch is currently available for affected PHP installations using vulnerable AVideo versions.
Unauthenticated SQL injection in AVideo before 24.0.
Server-side request forgery in AVideo prior to version 22.0 allows authenticated users to make arbitrary outbound requests from the affected server via an unvalidated downloadURL parameter in the aVideoEncoder.json.php endpoint. An attacker can exploit this to probe internal network services, access metadata endpoints, and retrieve sensitive data, potentially leading to further system compromise. This affects PHP deployments running vulnerable AVideo versions.
An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath parameter of the submitIndex.php component. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
AVideo through 29.0 is affected by a blind server-side request forgery (SSRF) in the getHeaderContentTypeFromURL function, which performs get_headers() calls on URL values that are only checked for format rather than destination. An authenticated user holding the canUpload permission can persist an attacker-chosen URL as a video link; the vulnerable lookup then fires on every render of that video's watch page, letting the attacker probe internal hosts and infer results through content-type differences and response timing. No public exploit code or CISA KEV entry is associated with this CVE at time of analysis, and no EPSS score was supplied in the input, so real-world exploitation activity remains unconfirmed.
Unauthenticated server-side request forgery in AVideo through version 29.0 lets remote attackers drive the server's own HTTP client to arbitrary destinations by supplying crafted Host headers to submitIndex.php or ajax.php. Because the check_site_availability function follows redirects without validating the host, an attacker can map internal hosts and open ports from the outside. No public exploit code or CISA KEV entry was provided in the intelligence feed, so exploitation status is unconfirmed, but the flaw requires no credentials and is trivially automatable.
Private playlist schedule metadata in WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) is exposed via missing ownership validation in the Playlists_schedules/list.json.php and Live/calendar.json.php PHP endpoints. Both unauthenticated requesters and low-privilege users holding canStream rights can supply arbitrary playlist identifiers to retrieve private schedule names, descriptions, timestamps, and playlist identifiers with no ownership verification performed server-side. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; real-world impact is bounded by the read-only, metadata-only nature of the disclosure.
Missing authorization in WWBN AVideo's video_from_program API endpoint allows unauthenticated network attackers to enumerate private playlist contents - including names, owner information, and video titles for password-protected playlists - without any credentials. All AVideo deployments through commit c3edcc274c389816d434acadac07ee78eaf330c1 are affected; the server-side API performs no ownership or session validation before returning playlist metadata. No active exploitation is listed in CISA KEV and no public exploit code has been identified, but the zero-complexity network vector makes this trivially exploitable against any reachable instance.
Missing authorization in the PlayerSkins mediaSession.json.php endpoint of WWBN AVideo exposes protected video metadata to unauthenticated network attackers. By supplying a video ID parameter to this endpoint, any remote attacker can retrieve the title and owner email address of password-protected videos without providing credentials, defeating the access-control intent of password protection. No public exploit or KEV listing is identified at time of analysis, and the CVSS 4.0 score of 6.9 reflects a narrowly scoped confidentiality impact limited to metadata rather than video content.
Unauthenticated information disclosure in WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 exposes password-protected video metadata to anonymous remote attackers via a missing authorization check on the videosAndroid.json.php endpoint. Any unauthenticated guest can retrieve sensitive owner data - including email addresses, last login timestamps, filenames, and hashIds - with a trivial GET request, bypassing the password-protection intent entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-authentication, zero-complexity attack surface makes opportunistic mass harvesting straightforward.
Missing authorization in WWBN AVideo's ImageGallery list.json.php endpoint allows unauthenticated attackers to enumerate password-protected gallery file listings and retrieve the exposed image files directly without credentials. All AVideo installations through commit c3edcc274c389816d434acadac07ee78eaf330c1 are affected when the ImageGallery plugin is active. No public exploit code or active exploitation has been identified at time of analysis, though the attack requires no technical sophistication and is trivially automatable.
Missing authorization in WWBN AVideo's Bookmark plugin exposes chapter names from password-protected videos to unauthenticated network attackers. The `getBookmarks.json.php` PHP endpoint accepts a video ID parameter and returns bookmark/chapter metadata without verifying that the requester holds the video password or any session credential, bypassing the password-protection model entirely for this data class. Exploitation is trivial given network access and a valid video ID; no KEV listing or public POC exists at time of analysis.
Missing authorization in AVideo's like.json.php endpoint allows any authenticated user to submit like interactions on password-protected or group-restricted videos they are not permitted to watch. The like counter for access-controlled content is incremented without the server verifying the requesting user's view permission, constituting a CWE-862 integrity bypass affecting all AVideo deployments through commit c3edcc274c389816d434acadac07ee78eaf330c1. No public exploit code has been identified at time of analysis, and real-world impact is bounded to engagement metric manipulation rather than content disclosure.
Missing authorization in WWBN AVideo's commentAddNew.json.php endpoint permits authenticated users to post comments on password-protected and group-restricted videos regardless of whether they can access the content. The flaw affects all releases through commit c3edcc274c389816d434acadac07ee78eaf330c1 of the self-hosted PHP video platform. An attacker holding any valid session can submit crafted POST requests to pollute comment threads on restricted videos, defeating both password and group-membership access controls without gaining actual view access to the content.
Missing authorization in WWBN AVideo's videoAddViewCount.json.php endpoint allows authenticated users to manipulate view counts and watch-time statistics on videos they are not permitted to access. Affected versions span all commits through c3edcc274c389816d434acadac07ee78eaf330c1 of the WWBN AVideo open-source PHP video platform. An attacker with any valid account can submit crafted requests with arbitrary video IDs to inflate engagement metrics on restricted or private content, undermining the integrity of access-controlled video libraries. No public exploit code or active exploitation has been identified at time of analysis.
Missing authentication in WWBN AVideo's Live plugin allows unauthenticated remote attackers to inject arbitrary socket notification messages to any administrator whose live stream key is known. The endpoint `/plugin/Live/socketMessageLiveOwner.json.php` validates that the stream *owner* holds admin privileges but performs no caller authentication (`User::isLogged()` is never invoked) and enforces no CSRF token, meaning the caller-identity check is entirely absent. No patch was available at time of publication; VulnCheck reported the issue against commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier.
Missing authorization in WWBN AVideo's remindMe.json.php endpoint allows authenticated users to create scheduler reminders for private live schedules they are not permitted to view. The generated email job leaks the private schedule's title back to the attacker, constituting an information disclosure via IDOR (CWE-639). Affected through commit c3edcc274c389816d434acadac07ee78eaf330c1 with no specific patched version confirmed at time of analysis; no public exploit code or CISA KEV entry exists.
Unauthenticated information disclosure in WWBN AVideo exposes internal menu configuration data via the plugin/TopMenu/menus.json.php endpoint, which lacks any authentication check. Remote unauthenticated attackers can send a plain GET request to retrieve all menu data, including names of admin-only and inactive menus that are intentionally hidden from the public navbar. No public exploit or active exploitation has been identified, but the endpoint requires zero preconditions against any network-accessible AVideo instance through the affected commit.
Missing authorization in WWBN AVideo's playListAddVideo.json.php endpoint allows authenticated users to add password-protected videos to their own playlists without possessing the watch permissions those videos require. The flaw, identified through commit c3edcc274c389816d434acadac07ee78eaf330c1, stems from the server trusting submitted video and playlist IDs without verifying whether the requesting user is authorized to access the referenced video content. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated information disclosure in WWBN AVideo through commit c3edcc274c exposes inactive admin menu items and embedded secret query parameters via the unprotected `plugin/TopMenu/menuItems.json.php` PHP endpoint. Any network-reachable attacker can POST a `menuId` parameter to retrieve admin-tool URLs that are hidden from the public navbar, including secret tokens or keys embedded directly in those URLs. While the direct impact is limited confidentiality exposure (CVSS 4.0 VC:L), the leaked secret query parameters represent a stepping stone that could enable follow-on attacks against otherwise-obscured admin functionality. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated information disclosure in WWBN AVideo exposes private playlist data for any user when an attacker supplies a target's user identifier to the playlistsFromUser.json.php endpoint. The root flaw is improper cache keying that fails to scope responses to the requesting user's session, allowing Favorite and Watch Later playlists to leak across user contexts. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthenticated information disclosure in WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 exposes owner user identifiers and personalized ad creative URLs for password-protected videos via the unguarded adsInfo API endpoint. Any network-accessible attacker can call the adsInfo endpoint with an arbitrary videos_id parameter and receive the video owner's internal user ID and ad-targeting data without credentials. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Missing ownership-check IDOR in AVideo through 29.0 allows an authenticated low-privilege user to recursively delete any category's on-disk asset directory (icons and images) regardless of ownership. The vulnerable endpoint `objects/categoryDeleteAssets.json.php` validates the CSRF nonce and the `canCreateCategory` capability but skips the `userCanEditCategory` ownership check enforced by the sibling delete handler, passing attacker-controlled category IDs directly to `Category::deleteAssets()`. No patched version was available at the time of advisory publication; exploitation requires the non-default `usersCanCreateNewCategories` site setting to be enabled.
Unauthenticated information disclosure in AVideo's WebRTC plugin exposes sensitive server-side configuration data to any remote user. When the WebRTC plugin is installed, the `/plugin/WebRTC/status.json.php` endpoint responds with the absolute filesystem path of the WebRTC2RTMP binary (revealing document-root layout), the configured WebRTC port, binary existence and executability status, WebRTC log file contents, and TCP reachability results for both loopback and the public address. The endpoint performs no authentication or authorization check of any kind, and no vendor patch had been released at the time of reporting.
XML injection in WWBN AVideo's AD_Server plugin (`plugin/AD_Server/VMAP.php`) allows a remote unauthenticated attacker to inject arbitrary VMAP ad-break nodes into video ad playlist responses when the AD_Server plugin is enabled. When a victim opens a crafted VMAP URL or a video page referencing it, the player's IMA ad client follows the injected ad tag URIs, enabling attacker-controlled ad injection and cross-origin requests from the victim's playback session. The vulnerability was unfixed at time of reporting, and no public exploit has been identified.
CSV formula injection in WWBN AVideo (through commit c3edcc274) enables authenticated users to embed spreadsheet formula payloads in comments that execute when administrators or video owners open exported CSV files from the myComments.download.php endpoint. The unsanitized comment text containing =, +, -, or @ prefixes is written directly into the CSV output, which spreadsheet applications interpret as executable expressions. Depending on the victim's application and security settings, this can chain to OS command execution via DDE or similar mechanisms, elevating a low-privilege user's impact to the admin's local session. No public exploit has been identified and it is not listed in CISA KEV.
Reflected XSS in WWBN AVideo's Gallery plugin allows unauthenticated remote attackers to inject arbitrary JavaScript into victims' browsers by supplying a malicious payload in the `getBackURL` GET parameter targeting `plugin/Gallery/view/Category.php`. The injected value is echoed directly into an href attribute without HTML encoding, enabling `javascript:` URI injection that fires when a visitor interacts with the Back navigation control while the SubCategorys feature is active. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 base score of 5.3 appropriately reflects the mandatory user-interaction step that constrains mass exploitation.
Server-side request forgery in WWBN AVideo's login endpoint enables unauthenticated remote attackers to read arbitrary local files or probe internal services by supplying crafted file paths or HTTP URLs to login.json.php. The vulnerability resides in the _json_decode function, which fetches attacker-supplied URLs and local paths without SSRF validation; the fetched content is then parsed as login credentials, creating an unusual secondary attack surface for potential authentication bypass against internal services that return predictable responses. Affected versions span all releases through commit c3edcc274c389816d434acadac07ee78eaf330c1, with no public exploit code identified at time of analysis.
Reflected XSS in WWBN AVideo's confirmLivePassword.php allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by tricking them into visiting a crafted URL. The vulnerability arises because the PHP script copies REQUEST_URI verbatim into an HTML form action attribute - a quote character in the URL path breaks attribute context and enables injection of arbitrary event handlers executing within the site's origin. No public exploit code or active exploitation has been identified at time of analysis, but the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms low-complexity unauthenticated exploitation gated only on passive victim interaction.
Reflected XSS in WWBN AVideo's Live plugin (plugin/Live/confirmLivePassword.php) allows remote unauthenticated attackers to execute arbitrary JavaScript in the browser of any user - including administrators - who follows a crafted link. The GET parameter `u` bypasses the application's `$securityFilter` and is interpolated without encoding directly into an HTML `<img src="...">` attribute, enabling attribute breakout and injected event-handler execution. No patched version was available at time of disclosure; no public exploit code or active exploitation (CISA KEV) has been identified.
Reflected XSS in WWBN AVideo's showAlertMessage() function allows unauthenticated attackers to inject arbitrary JavaScript into the site's execution context by abusing how the raw HTTP Referer header is embedded inside a JavaScript block comment without output encoding. Exploitation requires luring a victim to navigate to AVideo from an attacker-controlled page so the browser automatically includes the crafted Referer header. The injected script executes under the AVideo site origin, enabling session theft, credential harvesting, or UI redressing against authenticated users.
Open redirect combined with CSRF guard bypass in WWBN AVideo allows a remote unauthenticated attacker to redirect authenticated playlist managers to attacker-controlled phishing sites. The vulnerability resides in `objects/playlistSort.php`, which escapes AVideo's automatic CSRF protection because it lacks the `.json.php` filename suffix that triggers `autoCSRFGuard()`/`forbidIfIsUntrustedRequest()`, while simultaneously forwarding the unvalidated `HTTP_REFERER` header as a `Location` redirect without invoking AVideo's own `isSafeRedirectURL()` sanitizer. No patched version is available at time of analysis, leaving all AVideo deployments through commit c3edcc274c389816d434acadac07ee78eaf330c1 exposed to both playlist tampering and browser hijacking.
Incomplete authorization logic in AVideo's video API endpoint exposes private user account fields to any authenticated low-privilege user. The `API::get_api_video()` method calls `removeSensitiveUserFields()` only when the caller is a guest or lacks a valid API secret, but never compares the authenticated caller's user ID against the video row's `users_id` column. Any account holder can therefore request another user's video via `APIName=video` and receive the owner's email address, account name, isAdmin, canUpload, and canStream flags - data that should be restricted to the owner or callers with a valid API secret. No patch was available at the time of advisory publication; no public exploit has been identified at time of analysis.
Cross-site request forgery in AVideo's default-enabled CustomizeUser plugin allows an unauthenticated remote attacker to forge the ExtraSubscribers count on any user channel by inducing a logged-in administrator to load a crafted page containing an img tag. The root cause is that the setSubscribers.json.php endpoint accepts state-mutating GET requests via the $_REQUEST superglobal without any CSRF token validation, because autoCSRFGuard() is scoped exclusively to POST requests and the mutation path bypasses ObjectYPT::save()/isUntrustedRequest() checks. No vendor-released patch was available at the time of reporting; the issue affects all AVideo commits through c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23). No public exploit identified at time of analysis.
Cross-site request forgery in WWBN AVideo's CustomizeUser plugin allows an unauthenticated attacker to cause an authenticated administrator to lose administrative access. The `swapUser.json.php` endpoint accepts `users_id` via GET requests without CSRF token validation - the global `autoCSRFGuard()` guard is only applied to POST requests - meaning an img tag or crafted link embedded on any attacker-controlled page can silently invoke `User::swapUser()` in the context of a logged-in admin's browser session. Additionally, the JSON response leaks the target user's `session_id`, adding a secondary information disclosure impact. No patch was available at time of publication and the vulnerable plugin is enabled by default.
Unauthenticated cross-site scripting in AVideo's YPTSocket plugin allows remote attackers to execute arbitrary JavaScript in the browsers of connected users by sending crafted WebSocket messages. The attack leverages the plugin's WebSocket callback dispatch mechanism, which resolves attacker-controlled callback names to global JavaScript functions (e.g., `avideoConfirmHTML`) that assign untrusted message data directly to `innerHTML` without sanitization. Because the exploit path runs entirely through the WebSocket layer, no authentication and no secondary victim interaction beyond holding an active session are required, enabling persistent script injection into any connected user's origin context.
Rate limiting in AVideo's API is completely nullified when requests include a bot User-Agent header, exposing all eight rate-protected operations - most critically the login endpoint - to unlimited brute-force attempts from a single IP address. An unauthenticated remote attacker who sets any bot User-Agent string can bypass the application's only credential-stuffing defense and attempt unlimited password guesses against any account. No active exploitation (CISA KEV) or public proof-of-concept code has been identified at time of analysis.
Reflected cross-site scripting in AVideo's userLogin.php allows unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser by crafting a malicious URL with a script-breakout payload in the error parameter. The attack targets any user who follows the crafted link to the AVideo login page, enabling session hijacking, credential phishing overlays, or browser-based actions on behalf of the victim. No active exploitation (CISA KEV) is recorded and no public exploit code has been independently confirmed beyond the security advisory description.
Cross-site request forgery in AVideo's removePoster.php endpoint allows network-accessible attackers to permanently delete an authenticated victim's live poster and thumbnail files by tricking them into loading a crafted page. The endpoint accepts state-changing file-deletion operations over HTTP GET while performing neither POST-method enforcement (forbidIfNotPost) nor CSRF token validation (forbidIfInvalidToken), making the attack trivially embeddable in an HTML image tag. No active exploitation or public exploit code has been identified at time of analysis.
Reflected cross-site scripting in AVideo's userLogin.php allows unauthenticated network attackers to execute arbitrary JavaScript in a victim's browser by supplying a crafted cancelUri parameter. The isSafeRedirectURL validation function restricts only the URL protocol, leaving HTML metacharacters unchecked; a relative URL containing embedded quotes and event handlers bypasses the check entirely and is reflected verbatim into the href attribute of the Cancel button. Exploitation requires a victim to interact with the Cancel button after following a malicious link, placing this in the phishing-dependent reflected-XSS risk class.
Reflected XSS in AVideo's videoEmbeded.php allows unauthenticated remote attackers to execute arbitrary JavaScript in victims' browsers by delivering a crafted embed URL. The `link` GET parameter is echoed verbatim inside an HTML comment with no escaping, so injecting the sequence `-->` closes the comment context and enables arbitrary script injection. No active exploitation has been confirmed per CISA KEV, but the zero-friction delivery model - a victim clicking a malicious embed link - makes this a realistic phishing-chain enabler against authenticated AVideo users.
Broken access control in WWBN AVideo's unauthenticated feed/index.php RSS endpoint allows any remote attacker to bypass per-video visibility enforcement by supplying a program_id parameter, exposing unlisted and group-restricted video metadata and content URLs. The flaw is particularly severe in that empty playlist IDs trigger return of the platform's entire hidden video catalogue, making targeted enumeration trivial. No public exploit code or KEV listing confirmed at time of analysis; the CVSS 4.0 score of 6.9 reflects the unauthenticated, low-complexity network vector tempered by a limited confidentiality impact.
Broken access control on the WWBN AVideo public channel page allows unauthenticated remote visitors to retrieve full URLs of unlisted videos and thumbnails of member-only content, bypassing the operator-configured hidePrivateVideos setting. The flaw originates from hardcoded visibility flags and an undefined property check in the channel endpoint's authorization logic, rendering the platform's content-restriction model ineffective. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated HMAC token forgery in WWBN AVideo through commit 9c39d8c8 exposes a cryptographic oracle via encryptPass.json.php, allowing any remote attacker to compute valid authentication tokens using only the publicly known site base URL as the HMAC key. The endpoint accepts arbitrary plaintext passwords and returns AVideo-formatted encrypted hashes, functioning as an unrestricted hash oracle that enables offline precomputation attacks - particularly dangerous when combined with a separately stolen AVideo credential database. No active exploitation is confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.
Unauthenticated information disclosure in WWBN AVideo through 30.0 exposes sensitive configuration data via the MobileManager plugin's getConfiguration endpoint. Any remote attacker can issue a GET request to plugin/MobileManager/getConfiguration.json.php without credentials and receive TLS private key file paths, socket configuration details, platform version, and debug flags. While the direct confidentiality impact is limited (file paths and config metadata rather than key material itself), the leaked data provides meaningful reconnaissance for follow-on attacks targeting the installation. No public exploit or CISA KEV listing is identified at time of analysis.
Path traversal in WWBN AVideo's unauthenticated `get_api_login_code` API endpoint enables remote attackers to delete arbitrary `.log` files and enumerate filesystem paths by injecting directory traversal sequences into the `code` parameter. All versions covered by CPE `cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*` are affected, with exploitation requiring no authentication or user interaction. The primary security consequence is destruction of audit trails and access logs, which undermines incident detection and forensic response capabilities; no public exploit code has been identified at time of analysis.
Stored cross-site scripting in WWBN AVideo's Live_schedule module allows a low-privileged attacker with streaming permission to persist unsanitized JavaScript via the setTitle() and setDescription() POST endpoints. The injected payload is served to any user - including unauthenticated visitors - who loads remindMe.php, giving the stored payload a wider execution surface than the injection privilege level implies. No public exploit code has been identified at time of analysis, and the CVSS 4.0 score of 5.1 (Medium) reflects this split: low-privilege write, passive-interaction trigger, and limited per-browser impact.
Cross-site request forgery in WWBN AVideo's sendEmail.json.php endpoint enables network-based abuse of an authenticated administrator's session to dispatch arbitrary emails from the site's legitimate contact address. When an admin is tricked into visiting a malicious page while logged in, the attacker controls the email subject, body, and recipient list - and because the server sends the message itself, it passes SPF/DKIM/DMARC authentication, making it a viable phishing and brand impersonation vector. No public exploit has been identified at time of analysis; exploitation is constrained by the requirement for admin user interaction.
Reflected cross-site scripting in WWBN AVideo's url2Embed.json.php endpoint allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser session. The attack is distinctive because the malicious payload is delivered as an encrypted evideo parameter, enabling the crafted link to originate from the target site's own domain and bypass naive URL-reputation checks. Successful exploitation enables session cookie theft and CSRF token harvesting, facilitating account takeover. No public exploit or CISA KEV listing is identified at time of analysis.
WWBN AVideo's Live plugin exposes an unauthenticated endpoint at plugin/Live/api/preauthorize.json.php that accepts credentials via HTTP GET with no rate limiting, enabling two distinct abuse vectors: sustained brute-force password guessing against any user account and uncapped triggering of two-factor authentication confirmation emails. All versions of AVideo are affected per CPE data, and exploitation requires no privileges or user interaction. No public exploit code or active exploitation has been identified at time of analysis, though the attack surface is trivially low-complexity for any remote attacker.
Cross-site request forgery in AVideo's live-channel controls endpoint allows a remote, unauthenticated attacker to silently hijack a logged-in streamer's viewer-redirect configuration. The PHP endpoint `/plugin/Live/myLiveControls.save.json.php` accepts GET requests without a CSRF token or origin check, permitting an attacker who can socially engineer a streamer to visit a malicious page to overwrite `customUrl`, `customMessage`, and `autoRedirect` settings persisted in `users.externalOptions`. Downstream impact falls on stream viewers, who can be silently redirected to attacker-controlled phishing sites or shown spoofed messages. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 5.1 reflects the mandatory victim-interaction requirement.
Unauthenticated information disclosure in WWBN AVideo through version 30.0 exposes user registration statistics via two unprotected PHP endpoints. The report4.json.php and report4.1.json.php files return daily and cumulative user-registration counts to any remote requester without authentication or session validation. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog; however, its trivial exploitation path and network accessibility make it easy for any actor who can reach the server to enumerate platform growth data.
Server-side request forgery in AVideo before 24.0 allows unauthenticated network attackers to bypass SSRF protections in the isSSRFSafeURL function by encoding private IPv4 targets inside NAT64, 6to4, or Teredo IPv6 transition address formats. The LiveLinks proxy endpoint serves as the attack surface, enabling requests to reach internal network services and cloud instance metadata endpoints (e.g., 169.254.169.254 equivalents) that should be unreachable. No active exploitation is confirmed (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis; however, the unauthenticated network vector and patch availability make this a straightforward prioritization for any AVideo operator.
Cross-site request forgery in WWBN AVideo through commit 9c39d8c8 allows an authenticated attacker to silently transfer video ownership to an attacker-controlled account by planting a malicious img tag in a video description. The vulnerable endpoint, objects/videoEditLight.php, accepts GET requests without any authenticity token validation, making it trivially exploitable via passive browser-side request forgery when an administrator views the crafted video page. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 6.9 reflects meaningful integrity impact constrained by the requirement for low-privilege account access and administrator interaction.
Cross-site request forgery in AVideo through commit 9c39d8c8 enables unauthenticated remote attackers to modify site-wide Gallery plugin configuration by exploiting the absence of CSRF token validation in channelToGallery.json.php. Any administrator who visits a crafted page while holding an active session can be silently coerced into promoting arbitrary channels to the front page or deleting curated gallery sections. No public exploit code or CISA KEV listing has been identified at time of analysis, and the impact is confined to integrity and limited availability of gallery content.
Email enumeration in AVideo's RSS feed endpoint (feed/index.php) allows unauthenticated remote attackers to harvest channel owner email addresses across all versions through commit 9c39d8c8. By iterating through public channel names, attackers can systematically extract creator PII from the itunes:email and itunes:author elements of the platform's podcast-compatible RSS output. No public exploit has been identified at time of analysis, but the trivial exploitation path - a standard HTTP GET request requiring no credentials - substantially elevates downstream risk of phishing campaigns and credential-stuffing attacks targeting identified creators.
Unauthenticated arbitrary file write in AVideo's aVideoEncoderChunk.json.php endpoint allows remote attackers to write up to 4 GB of arbitrary content to the server filesystem via HTTP PUT requests, requiring no credentials of any kind. All AVideo versions (cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*) with this endpoint network-exposed are affected, as confirmed by the patch commit diff which shows authentication gating was entirely absent prior to the fix. Exploitation can cause denial of service via disk exhaustion, corrupt the video encoding pipeline, or - when chained with a local file inclusion vulnerability - escalate to remote code execution; no public exploit has been identified at time of analysis.
Stored cross-site scripting in AVideo's user registration flow allows any attacker who can reach the registration form to inject persistent JavaScript via the phone field, which later executes in administrator browsers when the users management page loads. The injected payload is rendered through JavaScript innerHTML in the admin bootgrid component without sanitization, running in the admin's session context and enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit or CISA KEV listing has been identified at time of analysis, though VulnCheck has documented and published an advisory for this vulnerability.
Stored cross-site scripting in AVideo's TopMenu plugin through version 26.0 allows payload execution for every site visitor due to unescaped rendering of icon classes, URLs, and text labels across multiple PHP templates. Critically, the saving endpoint (`menuItemSave.json.php`) lacks CSRF token validation despite checking for admin status, enabling a full CSRF-to-stored-XSS chain: an attacker with no account can inject the malicious menu item by luring an authenticated admin to an attacker-controlled page. Publicly available exploit code exists (GHSA-gmpc-fxg2-vcmq); no vendor-released patch has been identified at time of analysis.
Stored cross-site scripting in WWBN AVideo 29.0 and earlier allows an authenticated low-privilege user with category creation or editing rights to persist malicious JavaScript in category descriptions, which executes in any victim's browser upon viewing the Gallery or affected category page. The scope-changed CVSS vector (S:C) reflects that the injected payload crosses from the attacker's session into other users' browser contexts, enabling session hijacking or unauthorized actions on victims' behalf. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low-complexity, network-accessible attack path warrants prompt access control review on affected deployments.
Stored XSS in WWBN AVideo 29.0 and below allows authenticated attackers to inject arbitrary JavaScript via markdown comment links using `javascript:` URI schemes that bypass the platform's custom `ParsedownSafeWithLinks` sanitization. The incomplete fix for CVE-2026-27568 patched raw HTML `<a>` tag processing through `inlineMarkup()` but left Parsedown's `inlineLink()` and `inlineUrlTag()` methods unguarded, while simultaneously disabling Parsedown's built-in `safeMode` filtering - creating a clear bypass path. No public exploitation has been confirmed (not in CISA KEV), though SSVC designates a proof-of-concept as existing; EPSS is very low at 0.03% (9th percentile), indicating no widespread active exploitation at time of analysis.
Path traversal fix bypass in WWBN AVideo 29.0 and below allows authenticated uploaders to read arbitrary files from the server and exfiltrate them through a public GIF media URL. The partial fix in commit 2375eb5e0 validated only the URL path component via PHP's `parse_url()`, but the downstream `try_get_contents_from_local()` function in `objects/functionsFile.php` parses the full URL string - including query parameters - using `explode('/videos/', $url)`, enabling traversal payloads embedded in the query string to bypass the check entirely. A detailed proof-of-concept is publicly available in the GHSA-f4f9-627c-jh33 advisory; no CISA KEV listing exists, and EPSS at 0.20% reflects low automated exploitation probability consistent with the required authentication barrier.
Stored XSS in WWBN AVideo 29.0 and below allows authenticated uploaders to inject persistent JavaScript payloads via a malformed video duration field that bypasses input validation due to a missing regex end anchor. The crafted payload is stored in the database and rendered unescaped across trending, playlist, and gallery thumbnail pages, enabling session hijacking or credential theft against any visiting user including administrators. A proof-of-concept is documented in the GitHub Security Advisory; however, EPSS probability is very low (0.03%, 8th percentile) and no CISA KEV listing confirms active exploitation.
CAPTCHA bypass in WWBN AVideo 29.0 and prior enables unauthenticated attackers to defeat bot protection on user registration, password recovery, and contact form endpoints in at most 33 HTTP requests per session. Two cooperating flaws are responsible: the getCaptcha.php endpoint accepts the word-length parameter directly from the query string without bounds checking, allowing an attacker to force a 1-character CAPTCHA, and failed validation attempts do not invalidate the stored session token, enabling exhaustive brute-forcing of the 33-symbol alphabet. No CISA KEV listing exists, though SSVC rates the attack as automatable with POC-level exploitation, and the effective attack complexity is trivially low regardless of the AC:L CVSS rating.
Cross-site request forgery in WWBN AVideo 29.0 and prior allows an unauthenticated attacker to trigger mass comment deletion on behalf of any authenticated victim (moderator, video owner, or comment author) who visits a malicious page. The attack is critically amplified by AVideo's deliberate platform setting of `session.cookie_samesite=None`, which strips the browser's native CSRF defense and guarantees the victim's session cookie travels with every cross-origin request. Publicly available exploit code exists per SSVC data; the vulnerability is not listed in CISA KEV at time of analysis.
Cross-site request forgery in WWBN AVideo 29.0 and prior allows unauthenticated attackers to force logged-in victims into performing state-changing actions - posting attacker-authored comments under the victim's identity, manipulating comment likes/dislikes, and deleting category assets when the victim holds management rights. Exploitation requires only that the victim loads an attacker-controlled HTML page, making the attack trivially deliverable via email, forum post, or any embedded image. No public exploit confirmed beyond SSVC poc status; no officially released patched version has been confirmed despite a fix commit existing upstream.
Unauthenticated information disclosure in WWBN AVideo versions 29.0 and prior exposes the full output of `git log -1` via a publicly accessible `git.json.php` endpoint, leaking the exact deployed commit hash, developer names and email addresses, and commit messages to any network client without credentials. The commit hash enables an attacker to fingerprint the precise deployed version and cross-reference it against AVideo's 22 published GHSAs to enumerate which vulnerabilities remain unpatched on a given instance - making this a high-value reconnaissance primitive even at a moderate CVSS score. A public proof-of-concept exists; no patched version has been released as of time of publication.
Insecure Direct Object Reference in AVideo's live restream list endpoint exposes any victim user's RTMP stream keys and OAuth tokens - including access_token and refresh_token for YouTube Live, Facebook Live, and Twitch - to any peer with a streaming-permission account on the same instance. The flaw exists in versions 29.0 and prior, where the authorization guard in list.json.php is trivially bypassed by supplying an explicit users_id GET parameter, routing directly to an attacker-controlled database query. Publicly available exploit code exists per SSVC; EPSS is 0.03% (8th percentile), indicating limited opportunistic exploitation at this time, and the vulnerability is not listed in CISA KEV.
Stored SSRF in WWBN AVideo 26.0 and prior allows authenticated streamers with low-privilege streaming permissions to store arbitrary callback URLs in the live restream log feature, triggering server-side requests to internal or loopback HTTP services. The vulnerability affects all versions up to and including 26.0; exploitation requires valid streaming credentials but no user interaction. No public exploit code has been identified, though a proof-of-concept exists per CISA SSVC data.
Stored cross-site scripting (XSS) in WWBN AVideo 26.0 and prior allows authenticated users with upload permissions to inject malicious JavaScript into EPG (Electronic Program Guide) XML files, which executes in the browsers of unauthenticated visitors to the public EPG page without sanitization. Attackers can exploit this to hijack sessions and takeover accounts of any user viewing the compromised EPG. No public exploit code or active exploitation has been confirmed at the time of analysis.
Replay attack in WWBN AVideo versions 26.0 and prior allows authenticated attackers to repeatedly submit legitimate PayPal IPN notifications to the v1 handler, inflating wallet balances and renewing subscriptions without additional payment. The vulnerability exploits missing transaction deduplication in plugin/PayPalYPT/ipn.php, while newer v2 handlers correctly implement deduplication. CVSS 6.5 reflects high integrity impact with network accessibility and low attack complexity, though exploitation requires valid subscription credentials.
Cross-site request forgery in WWBN AVideo 26.0 and earlier allows unauthenticated remote attackers to overwrite the platform's logo file via a malicious cross-origin POST to the admin/customize_settings_nativeUpdate.json.php endpoint. The vulnerability exploits missing CSRF token validation combined with a SameSite=None cookie policy and a file-write-before-validation logic flaw, enabling integrity compromise of the site's branding. No public exploit code or active exploitation has been identified at the time of analysis.
Stored server-side request forgery (SSRF) in WWBN AVideo 26.0 and prior allows authenticated users with upload permissions to inject arbitrary URLs into the EPG (Electronic Program Guide) link feature, which the server automatically fetches on each EPG page visit. This enables attackers to scan internal networks, access cloud metadata services, and interact with internal services without the authentication or complexity barriers normally present in network-based attacks. No public exploit code identified at time of analysis.
Stored cross-site scripting (XSS) via unencoded HTML reflection in WWBN AVideo's User_Location plugin testIP.php endpoint allows authenticated attackers to execute arbitrary JavaScript in admin sessions. Affecting AVideo 26.0 and earlier, the vulnerability exploits SameSite=None cookie configuration to enable cross-origin exploitation, permitting unauthenticated attackers to lure admins to malicious links that hijack their authenticated context. No public exploit code or vendor patch has been released at time of analysis.
WWBN AVideo versions 26.0 and prior allow authenticated uploaders to bypass content moderation by directly setting video status to active via an unvalidated overrideStatus parameter, circumventing admin-controlled review workflows. The vulnerability affects any user with upload permissions and has a CVSS score of 4.3 (low-to-moderate severity) with no public exploit code identified at time of analysis.
Authenticated users in WWBN AVideo 26.0 and prior can cancel arbitrary Stripe subscriptions through an exposed test.php debug endpoint in the StripeYPT plugin, exploiting a logic error in the retrieveSubscriptions() method that performs cancellation instead of retrieval. The vulnerability requires valid login credentials but allows any authenticated user-not just administrators-to trigger subscription cancellations, causing integrity violations to payment operations. No public exploit code or active exploitation has been reported at time of analysis, and vendor patches are not yet available.
Stored cross-site scripting (XSS) in WWBN AVideo versions 26.0 and prior allows authenticated attackers to execute arbitrary JavaScript in the browsers of online users without any victim interaction. An attacker with a user account can set their display name to an XSS payload; when they initiate a call via the YPTSocket plugin, the caller notification rendered by the jQuery Toast Plugin executes the malicious script in every connected user's browser, enabling session hijacking, credential theft, or further compromise. CVSS 6.4 reflects moderate complexity due to authentication requirement and limited direct impact scope.
CSRF vulnerability in WWBN AVideo 26.0 and prior allows unauthenticated attackers to disable critical security plugins on admin accounts via malicious web pages, exploiting missing CSRF token validation combined with SameSite=None session cookies and ORM-level security bypass. An attacker can trick an authenticated administrator into visiting a crafted webpage that silently disables plugins such as LoginControl (2FA), subscription enforcement, or access control mechanisms, compromising the platform's security posture without the admin's knowledge or consent.
CSRF vulnerability in WWBN AVideo 26.0 and prior allows unauthenticated attackers to send arbitrary HTML emails to all platform users by luring administrators to a malicious webpage. The vulnerability exploits absent CSRF token validation on the emailAllUsers.json.php endpoint combined with SameSite=None session cookie configuration, enabling cross-origin POST requests to execute with the admin's session credentials. An attacker can impersonate the platform's legitimate SMTP sender to distribute phishing emails, spam, or malware links to the entire user base without any authentication requirement beyond initial admin compromise via social engineering.
Stored cross-site scripting (XSS) in WWBN AVideo 26.0 and prior allows unauthenticated attackers to inject malicious JavaScript into plugin configuration values via CSRF, or authenticated admins to directly inject code that executes in administrator browsers when accessing plugin configuration pages. The vulnerability exploits missing output encoding in the jsonToFormElements() function, enabling arbitrary JavaScript execution within the admin panel with impact to confidentiality and integrity.
Information disclosure in WWBN AVideo versions 26.0 and prior allows authenticated users to enumerate and dump the complete user database including personal information and wallet balances via the /plugin/YPTWallet/view/users.json.php endpoint. The vulnerability stems from inadequate authorization checks that verify user login status but fail to enforce administrator-only access, enabling any registered account holder to retrieve sensitive data belonging to all platform users. No public exploit code or active exploitation has been confirmed at time of analysis, and vendor patches are not yet available.
WWBN AVideo up to version 26.0 allows authenticated attackers to conduct concurrent balance transfers that exploit a Time-of-Check-Time-of-Use (TOCTOU) race condition in the wallet module, enabling arbitrary financial value multiplication without database transaction protection. An attacker with multiple authenticated sessions can trigger parallel transfer requests that each read the same wallet balance, all pass the sufficiency check independently, but result in only a single deduction while the recipient receives multiple credits. The vulnerability requires local authentication and moderate attacker effort (AC:H) but carries high integrity impact; no public exploit code or active exploitation has been identified at the time of analysis.
WWBN AVideo versions up to 26.0 expose all non-private video categories to unauthenticated remote attackers due to missing access control enforcement in the categories.json.php endpoint. The vulnerability combines two distinct flaws: complete bypass of group-based filtering when no user parameter is supplied, and a type confusion bug that substitutes the admin user's group memberships when a user parameter is present, allowing unauthorized disclosure of category metadata intended for restricted user groups. CVSS 5.3 reflects the information disclosure impact with no authentication required and low attack complexity; no public exploit code or active exploitation has been confirmed at time of analysis.
WWBN AVideo up to version 26.0 fails to enforce password verification on API endpoints `get_api_video_file` and `get_api_video`, allowing unauthenticated remote attackers to retrieve direct playback URLs (MP4 files and HLS manifests) for password-protected videos by directly invoking the API. The web interface enforces password checks through the `CustomizeUser::getModeYouTube()` hook, but this validation is entirely absent from the API code path, creating a complete authentication bypass. Upstream fix available via commit be344206f2f461c034ad2f1c5d8212dd8a52b8c7; no public exploit or active exploitation confirmed at time of analysis.
WWBN AVideo versions up to and including 26.0 contain an unauthenticated API endpoint that allows arbitrary decryption of ciphertext. Attackers can exploit the decryptString action in the API plugin without authentication to decrypt publicly-issued ciphertext (such as from view/url2Embed.json.php), allowing recovery of protected tokens and metadata. The CVSS score of 7.5 reflects high confidentiality impact with network accessibility and no authentication required.
WWBN AVideo open source video platform versions 25.0 and below ship with a hardcoded default administrator password ('password') in official Docker deployment files that is automatically used during installation without any forced change mechanism. Attackers can gain immediate administrative access to unpatched instances, enabling user data exposure, content manipulation, and potential remote code execution via file upload and plugin management features. The issue is compounded by weak MD5 password hashing and similarly insecure default database credentials (avideo/avideo).
Unauthenticated SQL injection in AVideo versions before 8.0 allows authenticated attackers to manipulate database queries through unsanitized sort parameters in POST requests, potentially leading to unauthorized data access or modification. The vulnerability stems from improper use of real_escape_string() on SQL identifiers rather than string literals, rendering the escaping mechanism ineffective. Affected organizations should upgrade to version 8.0 or implement WAF rules restricting sort parameter characters to alphanumeric and underscore values.
AVideo, a video-sharing platform, contains a Server-Side Request Forgery (SSRF) vulnerability in versions prior to 8.0 affecting the public thumbnail endpoints getImage.php and getImageMP4.php. Unauthenticated attackers can exploit insufficient URL validation to force the server to make requests to internal network resources including cloud metadata endpoints (AWS EC2 169.254.169.254), localhost, and private IP ranges. The vulnerability has a CVSS 4.0 score of 9.3 with network attack vector requiring no privileges or user interaction, though there is no evidence of active exploitation or public proof-of-concept at this time.
Unauthenticated OS command injection in AVideo before 7.0.
Memcached session storage exposure in AVideo prior to version 24.0 allows unauthenticated remote attackers to read, modify, or delete user sessions by accessing the publicly exposed memcached service on port 11211. An attacker with network access to this port can hijack admin accounts, impersonate users, or destroy all active sessions without any authentication. This affects the official Docker deployment configuration for PHP, Docker, and AVideo products.
Unauthenticated administrators in WWBN AVideo versions before 24.0 can achieve remote code execution by uploading malicious ZIP files through the plugin upload functionality, which extracts files without proper validation into web-accessible directories. This allows attackers to execute arbitrary PHP code on the server with high impact to confidentiality, integrity, and availability. No patch is currently available for affected PHP installations using vulnerable AVideo versions.
Unauthenticated SQL injection in AVideo before 24.0.
Server-side request forgery in AVideo prior to version 22.0 allows authenticated users to make arbitrary outbound requests from the affected server via an unvalidated downloadURL parameter in the aVideoEncoder.json.php endpoint. An attacker can exploit this to probe internal network services, access metadata endpoints, and retrieve sensitive data, potentially leading to further system compromise. This affects PHP deployments running vulnerable AVideo versions.
An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath parameter of the submitIndex.php component. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
AVideo through 29.0 is affected by a blind server-side request forgery (SSRF) in the getHeaderContentTypeFromURL function, which performs get_headers() calls on URL values that are only checked for format rather than destination. An authenticated user holding the canUpload permission can persist an attacker-chosen URL as a video link; the vulnerable lookup then fires on every render of that video's watch page, letting the attacker probe internal hosts and infer results through content-type differences and response timing. No public exploit code or CISA KEV entry is associated with this CVE at time of analysis, and no EPSS score was supplied in the input, so real-world exploitation activity remains unconfirmed.
Unauthenticated server-side request forgery in AVideo through version 29.0 lets remote attackers drive the server's own HTTP client to arbitrary destinations by supplying crafted Host headers to submitIndex.php or ajax.php. Because the check_site_availability function follows redirects without validating the host, an attacker can map internal hosts and open ports from the outside. No public exploit code or CISA KEV entry was provided in the intelligence feed, so exploitation status is unconfirmed, but the flaw requires no credentials and is trivially automatable.
Private playlist schedule metadata in WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) is exposed via missing ownership validation in the Playlists_schedules/list.json.php and Live/calendar.json.php PHP endpoints. Both unauthenticated requesters and low-privilege users holding canStream rights can supply arbitrary playlist identifiers to retrieve private schedule names, descriptions, timestamps, and playlist identifiers with no ownership verification performed server-side. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; real-world impact is bounded by the read-only, metadata-only nature of the disclosure.
Missing authorization in WWBN AVideo's video_from_program API endpoint allows unauthenticated network attackers to enumerate private playlist contents - including names, owner information, and video titles for password-protected playlists - without any credentials. All AVideo deployments through commit c3edcc274c389816d434acadac07ee78eaf330c1 are affected; the server-side API performs no ownership or session validation before returning playlist metadata. No active exploitation is listed in CISA KEV and no public exploit code has been identified, but the zero-complexity network vector makes this trivially exploitable against any reachable instance.
Missing authorization in the PlayerSkins mediaSession.json.php endpoint of WWBN AVideo exposes protected video metadata to unauthenticated network attackers. By supplying a video ID parameter to this endpoint, any remote attacker can retrieve the title and owner email address of password-protected videos without providing credentials, defeating the access-control intent of password protection. No public exploit or KEV listing is identified at time of analysis, and the CVSS 4.0 score of 6.9 reflects a narrowly scoped confidentiality impact limited to metadata rather than video content.
Unauthenticated information disclosure in WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 exposes password-protected video metadata to anonymous remote attackers via a missing authorization check on the videosAndroid.json.php endpoint. Any unauthenticated guest can retrieve sensitive owner data - including email addresses, last login timestamps, filenames, and hashIds - with a trivial GET request, bypassing the password-protection intent entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-authentication, zero-complexity attack surface makes opportunistic mass harvesting straightforward.
Missing authorization in WWBN AVideo's ImageGallery list.json.php endpoint allows unauthenticated attackers to enumerate password-protected gallery file listings and retrieve the exposed image files directly without credentials. All AVideo installations through commit c3edcc274c389816d434acadac07ee78eaf330c1 are affected when the ImageGallery plugin is active. No public exploit code or active exploitation has been identified at time of analysis, though the attack requires no technical sophistication and is trivially automatable.
Missing authorization in WWBN AVideo's Bookmark plugin exposes chapter names from password-protected videos to unauthenticated network attackers. The `getBookmarks.json.php` PHP endpoint accepts a video ID parameter and returns bookmark/chapter metadata without verifying that the requester holds the video password or any session credential, bypassing the password-protection model entirely for this data class. Exploitation is trivial given network access and a valid video ID; no KEV listing or public POC exists at time of analysis.
Missing authorization in AVideo's like.json.php endpoint allows any authenticated user to submit like interactions on password-protected or group-restricted videos they are not permitted to watch. The like counter for access-controlled content is incremented without the server verifying the requesting user's view permission, constituting a CWE-862 integrity bypass affecting all AVideo deployments through commit c3edcc274c389816d434acadac07ee78eaf330c1. No public exploit code has been identified at time of analysis, and real-world impact is bounded to engagement metric manipulation rather than content disclosure.
Missing authorization in WWBN AVideo's commentAddNew.json.php endpoint permits authenticated users to post comments on password-protected and group-restricted videos regardless of whether they can access the content. The flaw affects all releases through commit c3edcc274c389816d434acadac07ee78eaf330c1 of the self-hosted PHP video platform. An attacker holding any valid session can submit crafted POST requests to pollute comment threads on restricted videos, defeating both password and group-membership access controls without gaining actual view access to the content.
Missing authorization in WWBN AVideo's videoAddViewCount.json.php endpoint allows authenticated users to manipulate view counts and watch-time statistics on videos they are not permitted to access. Affected versions span all commits through c3edcc274c389816d434acadac07ee78eaf330c1 of the WWBN AVideo open-source PHP video platform. An attacker with any valid account can submit crafted requests with arbitrary video IDs to inflate engagement metrics on restricted or private content, undermining the integrity of access-controlled video libraries. No public exploit code or active exploitation has been identified at time of analysis.
Missing authentication in WWBN AVideo's Live plugin allows unauthenticated remote attackers to inject arbitrary socket notification messages to any administrator whose live stream key is known. The endpoint `/plugin/Live/socketMessageLiveOwner.json.php` validates that the stream *owner* holds admin privileges but performs no caller authentication (`User::isLogged()` is never invoked) and enforces no CSRF token, meaning the caller-identity check is entirely absent. No patch was available at time of publication; VulnCheck reported the issue against commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier.
Missing authorization in WWBN AVideo's remindMe.json.php endpoint allows authenticated users to create scheduler reminders for private live schedules they are not permitted to view. The generated email job leaks the private schedule's title back to the attacker, constituting an information disclosure via IDOR (CWE-639). Affected through commit c3edcc274c389816d434acadac07ee78eaf330c1 with no specific patched version confirmed at time of analysis; no public exploit code or CISA KEV entry exists.
Unauthenticated information disclosure in WWBN AVideo exposes internal menu configuration data via the plugin/TopMenu/menus.json.php endpoint, which lacks any authentication check. Remote unauthenticated attackers can send a plain GET request to retrieve all menu data, including names of admin-only and inactive menus that are intentionally hidden from the public navbar. No public exploit or active exploitation has been identified, but the endpoint requires zero preconditions against any network-accessible AVideo instance through the affected commit.
Missing authorization in WWBN AVideo's playListAddVideo.json.php endpoint allows authenticated users to add password-protected videos to their own playlists without possessing the watch permissions those videos require. The flaw, identified through commit c3edcc274c389816d434acadac07ee78eaf330c1, stems from the server trusting submitted video and playlist IDs without verifying whether the requesting user is authorized to access the referenced video content. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated information disclosure in WWBN AVideo through commit c3edcc274c exposes inactive admin menu items and embedded secret query parameters via the unprotected `plugin/TopMenu/menuItems.json.php` PHP endpoint. Any network-reachable attacker can POST a `menuId` parameter to retrieve admin-tool URLs that are hidden from the public navbar, including secret tokens or keys embedded directly in those URLs. While the direct impact is limited confidentiality exposure (CVSS 4.0 VC:L), the leaked secret query parameters represent a stepping stone that could enable follow-on attacks against otherwise-obscured admin functionality. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated information disclosure in WWBN AVideo exposes private playlist data for any user when an attacker supplies a target's user identifier to the playlistsFromUser.json.php endpoint. The root flaw is improper cache keying that fails to scope responses to the requesting user's session, allowing Favorite and Watch Later playlists to leak across user contexts. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthenticated information disclosure in WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 exposes owner user identifiers and personalized ad creative URLs for password-protected videos via the unguarded adsInfo API endpoint. Any network-accessible attacker can call the adsInfo endpoint with an arbitrary videos_id parameter and receive the video owner's internal user ID and ad-targeting data without credentials. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Missing ownership-check IDOR in AVideo through 29.0 allows an authenticated low-privilege user to recursively delete any category's on-disk asset directory (icons and images) regardless of ownership. The vulnerable endpoint `objects/categoryDeleteAssets.json.php` validates the CSRF nonce and the `canCreateCategory` capability but skips the `userCanEditCategory` ownership check enforced by the sibling delete handler, passing attacker-controlled category IDs directly to `Category::deleteAssets()`. No patched version was available at the time of advisory publication; exploitation requires the non-default `usersCanCreateNewCategories` site setting to be enabled.
Unauthenticated information disclosure in AVideo's WebRTC plugin exposes sensitive server-side configuration data to any remote user. When the WebRTC plugin is installed, the `/plugin/WebRTC/status.json.php` endpoint responds with the absolute filesystem path of the WebRTC2RTMP binary (revealing document-root layout), the configured WebRTC port, binary existence and executability status, WebRTC log file contents, and TCP reachability results for both loopback and the public address. The endpoint performs no authentication or authorization check of any kind, and no vendor patch had been released at the time of reporting.
XML injection in WWBN AVideo's AD_Server plugin (`plugin/AD_Server/VMAP.php`) allows a remote unauthenticated attacker to inject arbitrary VMAP ad-break nodes into video ad playlist responses when the AD_Server plugin is enabled. When a victim opens a crafted VMAP URL or a video page referencing it, the player's IMA ad client follows the injected ad tag URIs, enabling attacker-controlled ad injection and cross-origin requests from the victim's playback session. The vulnerability was unfixed at time of reporting, and no public exploit has been identified.
CSV formula injection in WWBN AVideo (through commit c3edcc274) enables authenticated users to embed spreadsheet formula payloads in comments that execute when administrators or video owners open exported CSV files from the myComments.download.php endpoint. The unsanitized comment text containing =, +, -, or @ prefixes is written directly into the CSV output, which spreadsheet applications interpret as executable expressions. Depending on the victim's application and security settings, this can chain to OS command execution via DDE or similar mechanisms, elevating a low-privilege user's impact to the admin's local session. No public exploit has been identified and it is not listed in CISA KEV.
Reflected XSS in WWBN AVideo's Gallery plugin allows unauthenticated remote attackers to inject arbitrary JavaScript into victims' browsers by supplying a malicious payload in the `getBackURL` GET parameter targeting `plugin/Gallery/view/Category.php`. The injected value is echoed directly into an href attribute without HTML encoding, enabling `javascript:` URI injection that fires when a visitor interacts with the Back navigation control while the SubCategorys feature is active. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 base score of 5.3 appropriately reflects the mandatory user-interaction step that constrains mass exploitation.
Server-side request forgery in WWBN AVideo's login endpoint enables unauthenticated remote attackers to read arbitrary local files or probe internal services by supplying crafted file paths or HTTP URLs to login.json.php. The vulnerability resides in the _json_decode function, which fetches attacker-supplied URLs and local paths without SSRF validation; the fetched content is then parsed as login credentials, creating an unusual secondary attack surface for potential authentication bypass against internal services that return predictable responses. Affected versions span all releases through commit c3edcc274c389816d434acadac07ee78eaf330c1, with no public exploit code identified at time of analysis.
Reflected XSS in WWBN AVideo's confirmLivePassword.php allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by tricking them into visiting a crafted URL. The vulnerability arises because the PHP script copies REQUEST_URI verbatim into an HTML form action attribute - a quote character in the URL path breaks attribute context and enables injection of arbitrary event handlers executing within the site's origin. No public exploit code or active exploitation has been identified at time of analysis, but the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms low-complexity unauthenticated exploitation gated only on passive victim interaction.
Reflected XSS in WWBN AVideo's Live plugin (plugin/Live/confirmLivePassword.php) allows remote unauthenticated attackers to execute arbitrary JavaScript in the browser of any user - including administrators - who follows a crafted link. The GET parameter `u` bypasses the application's `$securityFilter` and is interpolated without encoding directly into an HTML `<img src="...">` attribute, enabling attribute breakout and injected event-handler execution. No patched version was available at time of disclosure; no public exploit code or active exploitation (CISA KEV) has been identified.
Reflected XSS in WWBN AVideo's showAlertMessage() function allows unauthenticated attackers to inject arbitrary JavaScript into the site's execution context by abusing how the raw HTTP Referer header is embedded inside a JavaScript block comment without output encoding. Exploitation requires luring a victim to navigate to AVideo from an attacker-controlled page so the browser automatically includes the crafted Referer header. The injected script executes under the AVideo site origin, enabling session theft, credential harvesting, or UI redressing against authenticated users.
Open redirect combined with CSRF guard bypass in WWBN AVideo allows a remote unauthenticated attacker to redirect authenticated playlist managers to attacker-controlled phishing sites. The vulnerability resides in `objects/playlistSort.php`, which escapes AVideo's automatic CSRF protection because it lacks the `.json.php` filename suffix that triggers `autoCSRFGuard()`/`forbidIfIsUntrustedRequest()`, while simultaneously forwarding the unvalidated `HTTP_REFERER` header as a `Location` redirect without invoking AVideo's own `isSafeRedirectURL()` sanitizer. No patched version is available at time of analysis, leaving all AVideo deployments through commit c3edcc274c389816d434acadac07ee78eaf330c1 exposed to both playlist tampering and browser hijacking.
Incomplete authorization logic in AVideo's video API endpoint exposes private user account fields to any authenticated low-privilege user. The `API::get_api_video()` method calls `removeSensitiveUserFields()` only when the caller is a guest or lacks a valid API secret, but never compares the authenticated caller's user ID against the video row's `users_id` column. Any account holder can therefore request another user's video via `APIName=video` and receive the owner's email address, account name, isAdmin, canUpload, and canStream flags - data that should be restricted to the owner or callers with a valid API secret. No patch was available at the time of advisory publication; no public exploit has been identified at time of analysis.
Cross-site request forgery in AVideo's default-enabled CustomizeUser plugin allows an unauthenticated remote attacker to forge the ExtraSubscribers count on any user channel by inducing a logged-in administrator to load a crafted page containing an img tag. The root cause is that the setSubscribers.json.php endpoint accepts state-mutating GET requests via the $_REQUEST superglobal without any CSRF token validation, because autoCSRFGuard() is scoped exclusively to POST requests and the mutation path bypasses ObjectYPT::save()/isUntrustedRequest() checks. No vendor-released patch was available at the time of reporting; the issue affects all AVideo commits through c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23). No public exploit identified at time of analysis.
Cross-site request forgery in WWBN AVideo's CustomizeUser plugin allows an unauthenticated attacker to cause an authenticated administrator to lose administrative access. The `swapUser.json.php` endpoint accepts `users_id` via GET requests without CSRF token validation - the global `autoCSRFGuard()` guard is only applied to POST requests - meaning an img tag or crafted link embedded on any attacker-controlled page can silently invoke `User::swapUser()` in the context of a logged-in admin's browser session. Additionally, the JSON response leaks the target user's `session_id`, adding a secondary information disclosure impact. No patch was available at time of publication and the vulnerable plugin is enabled by default.
Unauthenticated cross-site scripting in AVideo's YPTSocket plugin allows remote attackers to execute arbitrary JavaScript in the browsers of connected users by sending crafted WebSocket messages. The attack leverages the plugin's WebSocket callback dispatch mechanism, which resolves attacker-controlled callback names to global JavaScript functions (e.g., `avideoConfirmHTML`) that assign untrusted message data directly to `innerHTML` without sanitization. Because the exploit path runs entirely through the WebSocket layer, no authentication and no secondary victim interaction beyond holding an active session are required, enabling persistent script injection into any connected user's origin context.
Rate limiting in AVideo's API is completely nullified when requests include a bot User-Agent header, exposing all eight rate-protected operations - most critically the login endpoint - to unlimited brute-force attempts from a single IP address. An unauthenticated remote attacker who sets any bot User-Agent string can bypass the application's only credential-stuffing defense and attempt unlimited password guesses against any account. No active exploitation (CISA KEV) or public proof-of-concept code has been identified at time of analysis.
Reflected cross-site scripting in AVideo's userLogin.php allows unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser by crafting a malicious URL with a script-breakout payload in the error parameter. The attack targets any user who follows the crafted link to the AVideo login page, enabling session hijacking, credential phishing overlays, or browser-based actions on behalf of the victim. No active exploitation (CISA KEV) is recorded and no public exploit code has been independently confirmed beyond the security advisory description.
Cross-site request forgery in AVideo's removePoster.php endpoint allows network-accessible attackers to permanently delete an authenticated victim's live poster and thumbnail files by tricking them into loading a crafted page. The endpoint accepts state-changing file-deletion operations over HTTP GET while performing neither POST-method enforcement (forbidIfNotPost) nor CSRF token validation (forbidIfInvalidToken), making the attack trivially embeddable in an HTML image tag. No active exploitation or public exploit code has been identified at time of analysis.
Reflected cross-site scripting in AVideo's userLogin.php allows unauthenticated network attackers to execute arbitrary JavaScript in a victim's browser by supplying a crafted cancelUri parameter. The isSafeRedirectURL validation function restricts only the URL protocol, leaving HTML metacharacters unchecked; a relative URL containing embedded quotes and event handlers bypasses the check entirely and is reflected verbatim into the href attribute of the Cancel button. Exploitation requires a victim to interact with the Cancel button after following a malicious link, placing this in the phishing-dependent reflected-XSS risk class.
Reflected XSS in AVideo's videoEmbeded.php allows unauthenticated remote attackers to execute arbitrary JavaScript in victims' browsers by delivering a crafted embed URL. The `link` GET parameter is echoed verbatim inside an HTML comment with no escaping, so injecting the sequence `-->` closes the comment context and enables arbitrary script injection. No active exploitation has been confirmed per CISA KEV, but the zero-friction delivery model - a victim clicking a malicious embed link - makes this a realistic phishing-chain enabler against authenticated AVideo users.
Broken access control in WWBN AVideo's unauthenticated feed/index.php RSS endpoint allows any remote attacker to bypass per-video visibility enforcement by supplying a program_id parameter, exposing unlisted and group-restricted video metadata and content URLs. The flaw is particularly severe in that empty playlist IDs trigger return of the platform's entire hidden video catalogue, making targeted enumeration trivial. No public exploit code or KEV listing confirmed at time of analysis; the CVSS 4.0 score of 6.9 reflects the unauthenticated, low-complexity network vector tempered by a limited confidentiality impact.
Broken access control on the WWBN AVideo public channel page allows unauthenticated remote visitors to retrieve full URLs of unlisted videos and thumbnails of member-only content, bypassing the operator-configured hidePrivateVideos setting. The flaw originates from hardcoded visibility flags and an undefined property check in the channel endpoint's authorization logic, rendering the platform's content-restriction model ineffective. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated HMAC token forgery in WWBN AVideo through commit 9c39d8c8 exposes a cryptographic oracle via encryptPass.json.php, allowing any remote attacker to compute valid authentication tokens using only the publicly known site base URL as the HMAC key. The endpoint accepts arbitrary plaintext passwords and returns AVideo-formatted encrypted hashes, functioning as an unrestricted hash oracle that enables offline precomputation attacks - particularly dangerous when combined with a separately stolen AVideo credential database. No active exploitation is confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.
Unauthenticated information disclosure in WWBN AVideo through 30.0 exposes sensitive configuration data via the MobileManager plugin's getConfiguration endpoint. Any remote attacker can issue a GET request to plugin/MobileManager/getConfiguration.json.php without credentials and receive TLS private key file paths, socket configuration details, platform version, and debug flags. While the direct confidentiality impact is limited (file paths and config metadata rather than key material itself), the leaked data provides meaningful reconnaissance for follow-on attacks targeting the installation. No public exploit or CISA KEV listing is identified at time of analysis.
Path traversal in WWBN AVideo's unauthenticated `get_api_login_code` API endpoint enables remote attackers to delete arbitrary `.log` files and enumerate filesystem paths by injecting directory traversal sequences into the `code` parameter. All versions covered by CPE `cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*` are affected, with exploitation requiring no authentication or user interaction. The primary security consequence is destruction of audit trails and access logs, which undermines incident detection and forensic response capabilities; no public exploit code has been identified at time of analysis.
Stored cross-site scripting in WWBN AVideo's Live_schedule module allows a low-privileged attacker with streaming permission to persist unsanitized JavaScript via the setTitle() and setDescription() POST endpoints. The injected payload is served to any user - including unauthenticated visitors - who loads remindMe.php, giving the stored payload a wider execution surface than the injection privilege level implies. No public exploit code has been identified at time of analysis, and the CVSS 4.0 score of 5.1 (Medium) reflects this split: low-privilege write, passive-interaction trigger, and limited per-browser impact.
Cross-site request forgery in WWBN AVideo's sendEmail.json.php endpoint enables network-based abuse of an authenticated administrator's session to dispatch arbitrary emails from the site's legitimate contact address. When an admin is tricked into visiting a malicious page while logged in, the attacker controls the email subject, body, and recipient list - and because the server sends the message itself, it passes SPF/DKIM/DMARC authentication, making it a viable phishing and brand impersonation vector. No public exploit has been identified at time of analysis; exploitation is constrained by the requirement for admin user interaction.
Reflected cross-site scripting in WWBN AVideo's url2Embed.json.php endpoint allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser session. The attack is distinctive because the malicious payload is delivered as an encrypted evideo parameter, enabling the crafted link to originate from the target site's own domain and bypass naive URL-reputation checks. Successful exploitation enables session cookie theft and CSRF token harvesting, facilitating account takeover. No public exploit or CISA KEV listing is identified at time of analysis.
WWBN AVideo's Live plugin exposes an unauthenticated endpoint at plugin/Live/api/preauthorize.json.php that accepts credentials via HTTP GET with no rate limiting, enabling two distinct abuse vectors: sustained brute-force password guessing against any user account and uncapped triggering of two-factor authentication confirmation emails. All versions of AVideo are affected per CPE data, and exploitation requires no privileges or user interaction. No public exploit code or active exploitation has been identified at time of analysis, though the attack surface is trivially low-complexity for any remote attacker.
Cross-site request forgery in AVideo's live-channel controls endpoint allows a remote, unauthenticated attacker to silently hijack a logged-in streamer's viewer-redirect configuration. The PHP endpoint `/plugin/Live/myLiveControls.save.json.php` accepts GET requests without a CSRF token or origin check, permitting an attacker who can socially engineer a streamer to visit a malicious page to overwrite `customUrl`, `customMessage`, and `autoRedirect` settings persisted in `users.externalOptions`. Downstream impact falls on stream viewers, who can be silently redirected to attacker-controlled phishing sites or shown spoofed messages. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 5.1 reflects the mandatory victim-interaction requirement.
Unauthenticated information disclosure in WWBN AVideo through version 30.0 exposes user registration statistics via two unprotected PHP endpoints. The report4.json.php and report4.1.json.php files return daily and cumulative user-registration counts to any remote requester without authentication or session validation. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog; however, its trivial exploitation path and network accessibility make it easy for any actor who can reach the server to enumerate platform growth data.
Server-side request forgery in AVideo before 24.0 allows unauthenticated network attackers to bypass SSRF protections in the isSSRFSafeURL function by encoding private IPv4 targets inside NAT64, 6to4, or Teredo IPv6 transition address formats. The LiveLinks proxy endpoint serves as the attack surface, enabling requests to reach internal network services and cloud instance metadata endpoints (e.g., 169.254.169.254 equivalents) that should be unreachable. No active exploitation is confirmed (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis; however, the unauthenticated network vector and patch availability make this a straightforward prioritization for any AVideo operator.
Cross-site request forgery in WWBN AVideo through commit 9c39d8c8 allows an authenticated attacker to silently transfer video ownership to an attacker-controlled account by planting a malicious img tag in a video description. The vulnerable endpoint, objects/videoEditLight.php, accepts GET requests without any authenticity token validation, making it trivially exploitable via passive browser-side request forgery when an administrator views the crafted video page. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 6.9 reflects meaningful integrity impact constrained by the requirement for low-privilege account access and administrator interaction.
Cross-site request forgery in AVideo through commit 9c39d8c8 enables unauthenticated remote attackers to modify site-wide Gallery plugin configuration by exploiting the absence of CSRF token validation in channelToGallery.json.php. Any administrator who visits a crafted page while holding an active session can be silently coerced into promoting arbitrary channels to the front page or deleting curated gallery sections. No public exploit code or CISA KEV listing has been identified at time of analysis, and the impact is confined to integrity and limited availability of gallery content.
Email enumeration in AVideo's RSS feed endpoint (feed/index.php) allows unauthenticated remote attackers to harvest channel owner email addresses across all versions through commit 9c39d8c8. By iterating through public channel names, attackers can systematically extract creator PII from the itunes:email and itunes:author elements of the platform's podcast-compatible RSS output. No public exploit has been identified at time of analysis, but the trivial exploitation path - a standard HTTP GET request requiring no credentials - substantially elevates downstream risk of phishing campaigns and credential-stuffing attacks targeting identified creators.
Unauthenticated arbitrary file write in AVideo's aVideoEncoderChunk.json.php endpoint allows remote attackers to write up to 4 GB of arbitrary content to the server filesystem via HTTP PUT requests, requiring no credentials of any kind. All AVideo versions (cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*) with this endpoint network-exposed are affected, as confirmed by the patch commit diff which shows authentication gating was entirely absent prior to the fix. Exploitation can cause denial of service via disk exhaustion, corrupt the video encoding pipeline, or - when chained with a local file inclusion vulnerability - escalate to remote code execution; no public exploit has been identified at time of analysis.
Stored cross-site scripting in AVideo's user registration flow allows any attacker who can reach the registration form to inject persistent JavaScript via the phone field, which later executes in administrator browsers when the users management page loads. The injected payload is rendered through JavaScript innerHTML in the admin bootgrid component without sanitization, running in the admin's session context and enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit or CISA KEV listing has been identified at time of analysis, though VulnCheck has documented and published an advisory for this vulnerability.
Stored cross-site scripting in AVideo's TopMenu plugin through version 26.0 allows payload execution for every site visitor due to unescaped rendering of icon classes, URLs, and text labels across multiple PHP templates. Critically, the saving endpoint (`menuItemSave.json.php`) lacks CSRF token validation despite checking for admin status, enabling a full CSRF-to-stored-XSS chain: an attacker with no account can inject the malicious menu item by luring an authenticated admin to an attacker-controlled page. Publicly available exploit code exists (GHSA-gmpc-fxg2-vcmq); no vendor-released patch has been identified at time of analysis.
Stored cross-site scripting in WWBN AVideo 29.0 and earlier allows an authenticated low-privilege user with category creation or editing rights to persist malicious JavaScript in category descriptions, which executes in any victim's browser upon viewing the Gallery or affected category page. The scope-changed CVSS vector (S:C) reflects that the injected payload crosses from the attacker's session into other users' browser contexts, enabling session hijacking or unauthorized actions on victims' behalf. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low-complexity, network-accessible attack path warrants prompt access control review on affected deployments.
Stored XSS in WWBN AVideo 29.0 and below allows authenticated attackers to inject arbitrary JavaScript via markdown comment links using `javascript:` URI schemes that bypass the platform's custom `ParsedownSafeWithLinks` sanitization. The incomplete fix for CVE-2026-27568 patched raw HTML `<a>` tag processing through `inlineMarkup()` but left Parsedown's `inlineLink()` and `inlineUrlTag()` methods unguarded, while simultaneously disabling Parsedown's built-in `safeMode` filtering - creating a clear bypass path. No public exploitation has been confirmed (not in CISA KEV), though SSVC designates a proof-of-concept as existing; EPSS is very low at 0.03% (9th percentile), indicating no widespread active exploitation at time of analysis.
Path traversal fix bypass in WWBN AVideo 29.0 and below allows authenticated uploaders to read arbitrary files from the server and exfiltrate them through a public GIF media URL. The partial fix in commit 2375eb5e0 validated only the URL path component via PHP's `parse_url()`, but the downstream `try_get_contents_from_local()` function in `objects/functionsFile.php` parses the full URL string - including query parameters - using `explode('/videos/', $url)`, enabling traversal payloads embedded in the query string to bypass the check entirely. A detailed proof-of-concept is publicly available in the GHSA-f4f9-627c-jh33 advisory; no CISA KEV listing exists, and EPSS at 0.20% reflects low automated exploitation probability consistent with the required authentication barrier.
Stored XSS in WWBN AVideo 29.0 and below allows authenticated uploaders to inject persistent JavaScript payloads via a malformed video duration field that bypasses input validation due to a missing regex end anchor. The crafted payload is stored in the database and rendered unescaped across trending, playlist, and gallery thumbnail pages, enabling session hijacking or credential theft against any visiting user including administrators. A proof-of-concept is documented in the GitHub Security Advisory; however, EPSS probability is very low (0.03%, 8th percentile) and no CISA KEV listing confirms active exploitation.
CAPTCHA bypass in WWBN AVideo 29.0 and prior enables unauthenticated attackers to defeat bot protection on user registration, password recovery, and contact form endpoints in at most 33 HTTP requests per session. Two cooperating flaws are responsible: the getCaptcha.php endpoint accepts the word-length parameter directly from the query string without bounds checking, allowing an attacker to force a 1-character CAPTCHA, and failed validation attempts do not invalidate the stored session token, enabling exhaustive brute-forcing of the 33-symbol alphabet. No CISA KEV listing exists, though SSVC rates the attack as automatable with POC-level exploitation, and the effective attack complexity is trivially low regardless of the AC:L CVSS rating.
Cross-site request forgery in WWBN AVideo 29.0 and prior allows an unauthenticated attacker to trigger mass comment deletion on behalf of any authenticated victim (moderator, video owner, or comment author) who visits a malicious page. The attack is critically amplified by AVideo's deliberate platform setting of `session.cookie_samesite=None`, which strips the browser's native CSRF defense and guarantees the victim's session cookie travels with every cross-origin request. Publicly available exploit code exists per SSVC data; the vulnerability is not listed in CISA KEV at time of analysis.
Cross-site request forgery in WWBN AVideo 29.0 and prior allows unauthenticated attackers to force logged-in victims into performing state-changing actions - posting attacker-authored comments under the victim's identity, manipulating comment likes/dislikes, and deleting category assets when the victim holds management rights. Exploitation requires only that the victim loads an attacker-controlled HTML page, making the attack trivially deliverable via email, forum post, or any embedded image. No public exploit confirmed beyond SSVC poc status; no officially released patched version has been confirmed despite a fix commit existing upstream.
Unauthenticated information disclosure in WWBN AVideo versions 29.0 and prior exposes the full output of `git log -1` via a publicly accessible `git.json.php` endpoint, leaking the exact deployed commit hash, developer names and email addresses, and commit messages to any network client without credentials. The commit hash enables an attacker to fingerprint the precise deployed version and cross-reference it against AVideo's 22 published GHSAs to enumerate which vulnerabilities remain unpatched on a given instance - making this a high-value reconnaissance primitive even at a moderate CVSS score. A public proof-of-concept exists; no patched version has been released as of time of publication.
Insecure Direct Object Reference in AVideo's live restream list endpoint exposes any victim user's RTMP stream keys and OAuth tokens - including access_token and refresh_token for YouTube Live, Facebook Live, and Twitch - to any peer with a streaming-permission account on the same instance. The flaw exists in versions 29.0 and prior, where the authorization guard in list.json.php is trivially bypassed by supplying an explicit users_id GET parameter, routing directly to an attacker-controlled database query. Publicly available exploit code exists per SSVC; EPSS is 0.03% (8th percentile), indicating limited opportunistic exploitation at this time, and the vulnerability is not listed in CISA KEV.
Stored SSRF in WWBN AVideo 26.0 and prior allows authenticated streamers with low-privilege streaming permissions to store arbitrary callback URLs in the live restream log feature, triggering server-side requests to internal or loopback HTTP services. The vulnerability affects all versions up to and including 26.0; exploitation requires valid streaming credentials but no user interaction. No public exploit code has been identified, though a proof-of-concept exists per CISA SSVC data.
Stored cross-site scripting (XSS) in WWBN AVideo 26.0 and prior allows authenticated users with upload permissions to inject malicious JavaScript into EPG (Electronic Program Guide) XML files, which executes in the browsers of unauthenticated visitors to the public EPG page without sanitization. Attackers can exploit this to hijack sessions and takeover accounts of any user viewing the compromised EPG. No public exploit code or active exploitation has been confirmed at the time of analysis.
Replay attack in WWBN AVideo versions 26.0 and prior allows authenticated attackers to repeatedly submit legitimate PayPal IPN notifications to the v1 handler, inflating wallet balances and renewing subscriptions without additional payment. The vulnerability exploits missing transaction deduplication in plugin/PayPalYPT/ipn.php, while newer v2 handlers correctly implement deduplication. CVSS 6.5 reflects high integrity impact with network accessibility and low attack complexity, though exploitation requires valid subscription credentials.
Cross-site request forgery in WWBN AVideo 26.0 and earlier allows unauthenticated remote attackers to overwrite the platform's logo file via a malicious cross-origin POST to the admin/customize_settings_nativeUpdate.json.php endpoint. The vulnerability exploits missing CSRF token validation combined with a SameSite=None cookie policy and a file-write-before-validation logic flaw, enabling integrity compromise of the site's branding. No public exploit code or active exploitation has been identified at the time of analysis.
Stored server-side request forgery (SSRF) in WWBN AVideo 26.0 and prior allows authenticated users with upload permissions to inject arbitrary URLs into the EPG (Electronic Program Guide) link feature, which the server automatically fetches on each EPG page visit. This enables attackers to scan internal networks, access cloud metadata services, and interact with internal services without the authentication or complexity barriers normally present in network-based attacks. No public exploit code identified at time of analysis.
Stored cross-site scripting (XSS) via unencoded HTML reflection in WWBN AVideo's User_Location plugin testIP.php endpoint allows authenticated attackers to execute arbitrary JavaScript in admin sessions. Affecting AVideo 26.0 and earlier, the vulnerability exploits SameSite=None cookie configuration to enable cross-origin exploitation, permitting unauthenticated attackers to lure admins to malicious links that hijack their authenticated context. No public exploit code or vendor patch has been released at time of analysis.
WWBN AVideo versions 26.0 and prior allow authenticated uploaders to bypass content moderation by directly setting video status to active via an unvalidated overrideStatus parameter, circumventing admin-controlled review workflows. The vulnerability affects any user with upload permissions and has a CVSS score of 4.3 (low-to-moderate severity) with no public exploit code identified at time of analysis.
Authenticated users in WWBN AVideo 26.0 and prior can cancel arbitrary Stripe subscriptions through an exposed test.php debug endpoint in the StripeYPT plugin, exploiting a logic error in the retrieveSubscriptions() method that performs cancellation instead of retrieval. The vulnerability requires valid login credentials but allows any authenticated user-not just administrators-to trigger subscription cancellations, causing integrity violations to payment operations. No public exploit code or active exploitation has been reported at time of analysis, and vendor patches are not yet available.
Stored cross-site scripting (XSS) in WWBN AVideo versions 26.0 and prior allows authenticated attackers to execute arbitrary JavaScript in the browsers of online users without any victim interaction. An attacker with a user account can set their display name to an XSS payload; when they initiate a call via the YPTSocket plugin, the caller notification rendered by the jQuery Toast Plugin executes the malicious script in every connected user's browser, enabling session hijacking, credential theft, or further compromise. CVSS 6.4 reflects moderate complexity due to authentication requirement and limited direct impact scope.
CSRF vulnerability in WWBN AVideo 26.0 and prior allows unauthenticated attackers to disable critical security plugins on admin accounts via malicious web pages, exploiting missing CSRF token validation combined with SameSite=None session cookies and ORM-level security bypass. An attacker can trick an authenticated administrator into visiting a crafted webpage that silently disables plugins such as LoginControl (2FA), subscription enforcement, or access control mechanisms, compromising the platform's security posture without the admin's knowledge or consent.
CSRF vulnerability in WWBN AVideo 26.0 and prior allows unauthenticated attackers to send arbitrary HTML emails to all platform users by luring administrators to a malicious webpage. The vulnerability exploits absent CSRF token validation on the emailAllUsers.json.php endpoint combined with SameSite=None session cookie configuration, enabling cross-origin POST requests to execute with the admin's session credentials. An attacker can impersonate the platform's legitimate SMTP sender to distribute phishing emails, spam, or malware links to the entire user base without any authentication requirement beyond initial admin compromise via social engineering.
Stored cross-site scripting (XSS) in WWBN AVideo 26.0 and prior allows unauthenticated attackers to inject malicious JavaScript into plugin configuration values via CSRF, or authenticated admins to directly inject code that executes in administrator browsers when accessing plugin configuration pages. The vulnerability exploits missing output encoding in the jsonToFormElements() function, enabling arbitrary JavaScript execution within the admin panel with impact to confidentiality and integrity.
Information disclosure in WWBN AVideo versions 26.0 and prior allows authenticated users to enumerate and dump the complete user database including personal information and wallet balances via the /plugin/YPTWallet/view/users.json.php endpoint. The vulnerability stems from inadequate authorization checks that verify user login status but fail to enforce administrator-only access, enabling any registered account holder to retrieve sensitive data belonging to all platform users. No public exploit code or active exploitation has been confirmed at time of analysis, and vendor patches are not yet available.
WWBN AVideo up to version 26.0 allows authenticated attackers to conduct concurrent balance transfers that exploit a Time-of-Check-Time-of-Use (TOCTOU) race condition in the wallet module, enabling arbitrary financial value multiplication without database transaction protection. An attacker with multiple authenticated sessions can trigger parallel transfer requests that each read the same wallet balance, all pass the sufficiency check independently, but result in only a single deduction while the recipient receives multiple credits. The vulnerability requires local authentication and moderate attacker effort (AC:H) but carries high integrity impact; no public exploit code or active exploitation has been identified at the time of analysis.
WWBN AVideo versions up to 26.0 expose all non-private video categories to unauthenticated remote attackers due to missing access control enforcement in the categories.json.php endpoint. The vulnerability combines two distinct flaws: complete bypass of group-based filtering when no user parameter is supplied, and a type confusion bug that substitutes the admin user's group memberships when a user parameter is present, allowing unauthorized disclosure of category metadata intended for restricted user groups. CVSS 5.3 reflects the information disclosure impact with no authentication required and low attack complexity; no public exploit code or active exploitation has been confirmed at time of analysis.
WWBN AVideo up to version 26.0 fails to enforce password verification on API endpoints `get_api_video_file` and `get_api_video`, allowing unauthenticated remote attackers to retrieve direct playback URLs (MP4 files and HLS manifests) for password-protected videos by directly invoking the API. The web interface enforces password checks through the `CustomizeUser::getModeYouTube()` hook, but this validation is entirely absent from the API code path, creating a complete authentication bypass. Upstream fix available via commit be344206f2f461c034ad2f1c5d8212dd8a52b8c7; no public exploit or active exploitation confirmed at time of analysis.