Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

AVideo — Vulnerabilities & Security Advisories 344

All 344 CVE vulnerabilities found in AVideo, with AI-generated Chinese analysis, references, and POCs.

This page documents security vulnerabilities associated with AVideo, a video management and streaming platform, categorized under weak encryption and access control weaknesses. It aggregates a comprehensive collection of disclosed security issues affecting this specific product, covering historical reports from early releases through the most recent updates identified in the database. By accessing this resource, users can effectively track vendor advisories to stay informed about the latest patches and mitigation strategies released by the developers. The content allows security professionals to understand the prevalence and impact of specific weakness classes within the AVideo ecosystem, facilitating better risk assessment and compliance management. Additionally, researchers and administrators can look up a product's vulnerability history to analyze patterns in defect introduction and resolution over time. This structured view supports informed decision-making regarding upgrade paths and configuration hardening without needing to scour multiple external sources. The data serves as a centralized reference point for identifying known risks, helping organizations prioritize remediation efforts based on severity and exploitability. Whether you are a system administrator ensuring server stability or a security analyst evaluating the supply chain risk, this aggregation provides the necessary context to maintain a secure deployment of AVideo. It bridges the gap between raw CVE data and actionable security intelligence, offering a clear overview of the product's security posture and evolution.

Vendor: WWBN

CVE ID Title CVSS Severity Published
CVE-2026-123486 WWBN AVideo 29.0 through 29.4.0 Race Condition in PayPal IPN Deduplication via ipn.php CWE-367 5.3 Medium 2026-11-06
CVE-2026-116800 WWBN AVideo before 29.5.0 Local PHP File Inclusion via Accept-Language Header CWE-22 6.2 Medium 2026-10-26
CVE-2026-116139 WWBN AVideo 26.0 through 29.3.0 Stored XSS via Comment Markdown Rendering CWE-79 5.4 Medium 2026-10-25
CVE-2026-114634 WWBN AVideo before 29.4.0 Blind SSRF via getHeaderContentTypeFromURL Redirect CWE-918 4.3 Medium 2026-10-22
CVE-2026-114633 WWBN AVideo before 29.4.0 Incorrect Authorization via confirmDeleteUser.json.php CWE-863 6.5 Medium 2026-10-22
CVE-2026-114048 WWBN AVideo before 24.0 CSRF via Legacy Playlist and Video Endpoints CWE-352 3.5 Low 2026-10-21
CVE-2026-105086 WWBN AVideo 12.4 through 29.2.0 Stored XSS via Double-Encoded Video Title CWE-79 8.7 High 2026-10-04
CVE-2026-105089 WWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHPFlix2 Templates CWE-79 8.7 High 2026-10-04
CVE-2026-100630 AVideo before 29.1.0 Stored XSS via HTML Entity Bypass in trailer1 Field CWE-79 5.4 Medium 2026-09-26
CVE-2026-92915 WWBN AVideo userVerifyEmail.php Unauthenticated Access Control CWE-770 7.3 High 2026-09-17
CVE-2026-92914 AVideo LoginControl PGP Second Factor Authentication Bypass CWE-287 8.1 High 2026-09-17
CVE-2026-92913 AVideo Weak PRNG Activation Code Authentication Bypass CWE-330 7.4 High 2026-09-17
CVE-2026-92912 AVideo Cryptographically Weak PRNG via uniqid Stream Key CWE-330 6.5 Medium 2026-09-17
CVE-2026-92586 AVideo through 29.0 Missing Authorization via comment API endpoint CWE-862 4.3 Medium 2026-09-16
CVE-2026-92585 AVideo through 29.0 Missing Authorization Check via API Like Endpoint CWE-862 4.3 Medium 2026-09-16
CVE-2026-92584 AVideo through 29.0 Stored Cross-Site Scripting via User-Agent Header CWE-79 6.1 Medium 2026-09-16
CVE-2026-92583 AVideo through 29.0 Rate Limit Bypass via Non-Atomic Counter Increment CWE-307 6.5 Medium 2026-09-16
CVE-2026-92582 AVideo through 29.0 Broken Access Control via videoAddNew.json.php CSRF Bypass CWE-352 7.1 High 2026-09-16
CVE-2026-92580 AVideo through 29.0 CloneSite Stored Shell Injection via SSH Password CSRF CWE-78 8.8 High 2026-09-16
CVE-2026-92581 AVideo through 29.0 Like Counter Desynchronization via Array Parameter CWE-20 4.3 Medium 2026-09-16
CVE-2026-92579 AVideo through 29.0 Broken Access Control via CSRF Exemption Basename Collision CWE-289 5.4 Medium 2026-09-16
CVE-2026-92578 WWBN AVideo through 29.0 Authentication Bypass via Stored Password Hash CWE-287 8.1 High 2026-09-16
CVE-2026-92577 AVideo through 29.0 API get_api_video Broken Access Control via clean_title CWE-639 7.5 High 2026-09-16
CVE-2026-91966 AVideo through 29.0 Unauthenticated SSRF via Host Header CWE-918 5.8 Medium 2026-09-15
CVE-2026-91967 AVideo through 29.0 Blind SSRF via getHeaderContentTypeFromURL CWE-918 5.0 Medium 2026-09-15
CVE-2026-91965 WWBN AVideo through 29.0 Broken Access Control via Live Endpoints CWE-200 7.5 High 2026-09-15
CVE-2026-90552 WWBN AVideo Missing Authorization via Playlists_schedules list.json.php CWE-639 4.3 Medium 2026-09-12
CVE-2026-90550 WWBN AVideo Missing Authorization via mediaSession.json.php CWE-200 5.3 Medium 2026-09-12
CVE-2026-90551 WWBN AVideo Missing Authorization via video_from_program API CWE-862 5.3 Medium 2026-09-12
CVE-2026-90549 WWBN AVideo Missing Authorization via videosAndroid.json.php Endpoint CWE-200 5.3 Medium 2026-09-12

All 344 known CVE vulnerabilities affecting AVideo with full Chinese analysis, references, and POCs where available.