Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

AVideo — Vulnerabilities & Security Advisories 344

All 344 CVE vulnerabilities found in AVideo, with AI-generated Chinese analysis, references, and POCs.

This page documents security vulnerabilities associated with AVideo, a video management and streaming platform, categorized under weak encryption and access control weaknesses. It aggregates a comprehensive collection of disclosed security issues affecting this specific product, covering historical reports from early releases through the most recent updates identified in the database. By accessing this resource, users can effectively track vendor advisories to stay informed about the latest patches and mitigation strategies released by the developers. The content allows security professionals to understand the prevalence and impact of specific weakness classes within the AVideo ecosystem, facilitating better risk assessment and compliance management. Additionally, researchers and administrators can look up a product's vulnerability history to analyze patterns in defect introduction and resolution over time. This structured view supports informed decision-making regarding upgrade paths and configuration hardening without needing to scour multiple external sources. The data serves as a centralized reference point for identifying known risks, helping organizations prioritize remediation efforts based on severity and exploitability. Whether you are a system administrator ensuring server stability or a security analyst evaluating the supply chain risk, this aggregation provides the necessary context to maintain a secure deployment of AVideo. It bridges the gap between raw CVE data and actionable security intelligence, offering a clear overview of the product's security posture and evolution.

Vendor: WWBN

CVE ID Title CVSS Severity Published
CVE-2026-33293 AVideo Affected by Arbitrary File Deletion via Path Traversal in CloneSite deleteDump Parameter CWE-22 8.1 High 2026-03-22
CVE-2026-33319 AVideo Vulnerable to OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command CWE-78 5.9 Medium 2026-03-22
CVE-2026-33292 AVideo has Authorization Bypass via Path Traversal in HLS Endpoint Allows Streaming Private/Paid Videos CWE-22 7.5 High 2026-03-22
CVE-2026-33238 AVideo has a Path Traversal in listFiles.json.php that Enables Server Filesystem Enumeration CWE-22 4.3 Medium 2026-03-20
CVE-2026-33237 AVideo has SSRF in Scheduler Plugin via callbackURL Missing `isSSRFSafeURL()` Validation CWE-918 5.5 Medium 2026-03-20
CVE-2026-33043 AVideo affected by Session Hijacking via Unauthenticated Session ID Disclosure with Permissive CORS CWE-942 8.1 High 2026-03-20
CVE-2026-33041 AVideo has an Unauthenticated Password Hash Oracle via encryptPass.json.php CWE-200 5.3 Medium 2026-03-20
CVE-2026-33039 AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy CWE-918 8.6 High 2026-03-20
CVE-2026-33038 AVideo affected by unauthenticated application takeover via exposed web installer on uninitialized deployments CWE-306 8.1 High 2026-03-20
CVE-2026-33037 WWBN AVideo has predictable default admin credentials in official Docker deployment path CWE-1188 8.1 High 2026-03-20
CVE-2026-33035 Unauthenticated Reflected XSS via innerHTML in AVideo CWE-79 6.1 - 2026-03-20
CVE-2026-30885 WWBN AVideo - Unauthenticated IDOR - Playlist Information Disclosure CWE-306 5.3AI Medium AI 2026-03-09
CVE-2026-28501 WWBN AVideo: Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php CWE-89 9.8 Critical 2026-03-06
CVE-2026-28502 WWBN AVideo: Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction CWE-434 7.2 - 2026-03-06
CVE-2026-29093 WWBN AVideo: Unauthenticated PHP session store exposed to host network via published memcached port CWE-287 8.1 High 2026-03-06
CVE-2026-27732 AVideo has Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.php CWE-918 8.1 - 2026-02-24
CVE-2026-27568 AVideo has Stored Cross-Site Scripting via Markdown Comment Injection CWE-79 9.0 - 2026-02-24
CVE-2025-34433 AVideo < 20.1 Unauthenticated RCE via Predictable Installation Salt CWE-94 9.8AI Critical AI 2025-12-19
CVE-2025-34438 AVideo < 20.1 IDOR Arbitrary Video Rotation CWE-639 4.3AI Medium AI 2025-12-17
CVE-2025-34437 AVideo < 20.1 IDOR Arbitrary Comment Image Upload CWE-639 4.3AI Medium AI 2025-12-17
CVE-2025-34435 AVideo < 20.1 IDOR Arbitrary File Deletion CWE-639 6.5AI Medium AI 2025-12-17
CVE-2025-34436 AVideo < 20.1 IDOR Arbitrary File Upload CWE-639 6.5AI Medium AI 2025-12-17
CVE-2025-34434 AVideo < 20.1 ImageGallery Plugin Unauthenticated File Upload and Deletion CWE-306 9.1AI Critical AI 2025-12-17
CVE-2025-34439 AVideo < 20.1 Open Redirect via cancelUri Parameter CWE-601 6.1AI Medium AI 2025-12-17
CVE-2025-34440 AVideo < 20.1 Open Redirect via siteRedirectUri Parameter CWE-601 6.1AI Medium AI 2025-12-17
CVE-2025-34442 AVideo < 20.1 System Path Disclosure via Public API CWE-497 5.3AI Medium AI 2025-12-17
CVE-2025-34441 AVideo < 20.1 User Information Disclosure via Public API CWE-359 7.5AI High AI 2025-12-17
CVE-2025-46410 WWBN AVideo 跨站脚本漏洞 CWE-79 9.6 Critical 2025-07-24
CVE-2025-53084 多款产品跨站脚本漏洞 CWE-79 9.0 Critical 2025-07-24
CVE-2025-50128 WWBN AVideo 跨站脚本漏洞 CWE-79 9.6 Critical 2025-07-24

All 344 known CVE vulnerabilities affecting AVideo with full Chinese analysis, references, and POCs where available.