Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

AVideo — Vulnerabilities & Security Advisories 344

All 344 CVE vulnerabilities found in AVideo, with AI-generated Chinese analysis, references, and POCs.

This page documents security vulnerabilities associated with AVideo, a video management and streaming platform, categorized under weak encryption and access control weaknesses. It aggregates a comprehensive collection of disclosed security issues affecting this specific product, covering historical reports from early releases through the most recent updates identified in the database. By accessing this resource, users can effectively track vendor advisories to stay informed about the latest patches and mitigation strategies released by the developers. The content allows security professionals to understand the prevalence and impact of specific weakness classes within the AVideo ecosystem, facilitating better risk assessment and compliance management. Additionally, researchers and administrators can look up a product's vulnerability history to analyze patterns in defect introduction and resolution over time. This structured view supports informed decision-making regarding upgrade paths and configuration hardening without needing to scour multiple external sources. The data serves as a centralized reference point for identifying known risks, helping organizations prioritize remediation efforts based on severity and exploitability. Whether you are a system administrator ensuring server stability or a security analyst evaluating the supply chain risk, this aggregation provides the necessary context to maintain a secure deployment of AVideo. It bridges the gap between raw CVE data and actionable security intelligence, offering a clear overview of the product's security posture and evolution.

Vendor: WWBN

CVE ID Title CVSS Severity Published
CVE-2026-86187 WWBN AVideo Weak PRNG Password Generation via External Login CWE-330 5.9 Medium 2026-09-05
CVE-2026-86186 AVideo API Rate Limit Bypass via Bot User-Agent Header CWE-307 6.5 Medium 2026-09-05
CVE-2026-85577 AVideo userLogin.php Reflected XSS via error parameter CWE-79 5.4 Medium 2026-09-04
CVE-2026-85163 AVideo Server-Side Request Forgery via epg_link parameter CWE-918 6.5 Medium 2026-09-03
CVE-2026-85164 WWBN AVideo Server-Side Request Forgery via set_api_userImages CWE-918 7.1 High 2026-09-03
CVE-2026-85162 AVideo through c91b5975d CSRF via saveLive.php CWE-352 6.5 Medium 2026-09-03
CVE-2026-85161 AVideo removePoster.php Cross-Site Request Forgery File Deletion CWE-352 4.3 Medium 2026-09-03
CVE-2026-85160 AVideo through c91b5975d CSRF and Path Traversal via stopLive.php CWE-73 8.1 High 2026-09-03
CVE-2026-85159 AVideo Reflected XSS via cancelUri in userLogin.php CWE-79 5.4 Medium 2026-09-03
CVE-2026-85157 WWBN AVideo Broken Access Control via feed/index.php program_id CWE-200 5.3 Medium 2026-09-03
CVE-2026-85158 AVideo Reflected XSS via videoEmbeded.php link parameter CWE-79 5.4 Medium 2026-09-03
CVE-2026-85156 WWBN AVideo Broken Access Control via Channel Page CWE-200 5.3 Medium 2026-09-03
CVE-2026-85155 WWBN AVideo SQL Injection via get.json.php APIName channels CWE-89 7.5 High 2026-09-03
CVE-2026-85154 WWBN AVideo Authentication Bypass via Non-Expiring video_id_hash CWE-269 9.8 Critical 2026-09-03
CVE-2026-84483 WWBN AVideo Unauthenticated Password Hash Oracle via encryptPass.json.php CWE-321 5.3 Medium 2026-09-01
CVE-2026-84482 WWBN AVideo Cross-Site Request Forgery via get_domain() validation CWE-346 8.8 High 2026-09-01
CVE-2026-84481 WWBN AVideo through 30.0 Information Disclosure via MobileManager CWE-200 6.9 Medium 2026-09-01
CVE-2026-84480 WWBN AVideo Password Recovery Token Expiration Bypass CWE-613 9.8 Critical 2026-09-01
CVE-2026-84479 WWBN AVideo Authentication Bypass via User-Agent Header CWE-290 9.1 Critical 2026-09-01
CVE-2026-84477 AVideo Stored XSS via Live Schedule Title Description CWE-79 5.4 Medium 2026-09-01
CVE-2026-84478 WWBN AVideo Unauthenticated Arbitrary Log File Deletion CWE-73 7.3 High 2026-09-01
CVE-2026-84476 WWBN AVideo Authentication Bypass via X-Real-IP Header CWE-290 7.5 High 2026-09-01
CVE-2026-84208 AVideo User_Location Plugin Unauthenticated SQL Injection CWE-89 7.5 High 2026-09-01
CVE-2026-83595 AVideo Cross-Site Request Forgery via plugin/API/set.json.php CWE-352 8.1 High 2026-09-01
CVE-2026-84187 AVideo on_publish.php Missing Authentication Check via RTMP Callback CWE-284 8.2 High 2026-09-01
CVE-2026-82648 WWBN AVideo SSRF Filter Bypass via NAT64 Hex Address CWE-20 7.1 High 2026-08-30
CVE-2026-82646 WWBN AVideo Unauthenticated Reflected XSS via url2Embed.json.php CWE-79 6.1 Medium 2026-08-30
CVE-2026-82647 WWBN AVideo Cross-Site Request Forgery via sendEmail.json.php CWE-352 6.1 Medium 2026-08-30
CVE-2026-82645 AVideo Unauthenticated Stream Credential Disclosure via Forgeable Token CWE-347 8.6 High 2026-08-30
CVE-2026-82644 WWBN AVideo Brute-force Rate Limiting Bypass via Missing User-Agent CWE-307 7.5 High 2026-08-30

All 344 known CVE vulnerabilities affecting AVideo with full Chinese analysis, references, and POCs where available.