Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

AVideo — Vulnerabilities & Security Advisories 344

All 344 CVE vulnerabilities found in AVideo, with AI-generated Chinese analysis, references, and POCs.

This page documents security vulnerabilities associated with AVideo, a video management and streaming platform, categorized under weak encryption and access control weaknesses. It aggregates a comprehensive collection of disclosed security issues affecting this specific product, covering historical reports from early releases through the most recent updates identified in the database. By accessing this resource, users can effectively track vendor advisories to stay informed about the latest patches and mitigation strategies released by the developers. The content allows security professionals to understand the prevalence and impact of specific weakness classes within the AVideo ecosystem, facilitating better risk assessment and compliance management. Additionally, researchers and administrators can look up a product's vulnerability history to analyze patterns in defect introduction and resolution over time. This structured view supports informed decision-making regarding upgrade paths and configuration hardening without needing to scour multiple external sources. The data serves as a centralized reference point for identifying known risks, helping organizations prioritize remediation efforts based on severity and exploitability. Whether you are a system administrator ensuring server stability or a security analyst evaluating the supply chain risk, this aggregation provides the necessary context to maintain a secure deployment of AVideo. It bridges the gap between raw CVE data and actionable security intelligence, offering a clear overview of the product's security posture and evolution.

Vendor: WWBN

CVE ID Title CVSS Severity Published
CVE-2026-82644 WWBN AVideo Brute-force Rate Limiting Bypass via Missing User-Agent CWE-307 7.5 High 2026-08-30
CVE-2026-81733 WWBN AVideo through 30.0 CSRF via myLiveControls.save.json.php CWE-352 5.1 Medium 2026-08-28
CVE-2026-81732 WWBN AVideo through 30.0 Information Disclosure via report4.json.php CWE-200 6.9 Medium 2026-08-28
CVE-2026-81678 AVideo SSRF Guard Bypass via IPv6 Transition Addresses CWE-918 7.5 High 2026-08-27
CVE-2026-59808 AVideo Authentication Bypass via Unkeyed Video Hash Disclosure CWE-306 8.8 High 2026-08-22
CVE-2026-59256 WWBN AVideo Unbound Token Authorization Bypass via Gallery CWE-200 7.5 High 2026-08-22
CVE-2026-58003 WWBN AVideo Cross-Site Request Forgery via releaseVideoNow.json.php CWE-352 7.1 High 2026-08-22
CVE-2026-58002 WWBN AVideo Authorization Bypass via Users_affiliations add.json.php CWE-345 6.5 Medium 2026-08-22
CVE-2026-58001 WWBN AVideo Cross-Site Request Forgery via videoEditLight.php CWE-352 5.7 Medium 2026-08-22
CVE-2026-57944 AVideo channelToGallery.json.php Cross-Site Request Forgery CWE-352 5.4 Medium 2026-08-22
CVE-2026-56380 AVideo feed/index.php Exposure of Channel Owner Email Address CWE-200 5.3 Medium 2026-08-22
CVE-2026-72748 AVideo Unauthenticated Arbitrary File Write via aVideoEncoderChunk.json.php CWE-306 9.1 Critical 2026-08-11
CVE-2026-72747 AVideo Stored Cross-Site Scripting via Unauthenticated Registration CWE-79 7.2 High 2026-08-11
CVE-2026-64626 AVideo Encoder downloadURL SSRF via unpinned retry fallback CWE-918 6.4 Medium 2026-07-20
CVE-2026-64625 AVideo before 29.0 OS Command Injection via execAsync CWE-78 9.8 Critical 2026-07-20
CVE-2026-33731 AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data CWE-345 6.5 Medium 2026-07-16
CVE-2026-55173 AVideo incomplete fix for CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command execution at the same execAsync sh -c sink CWE-78 8.1 High 2026-07-16
CVE-2026-33692 AVideo Has Unauthenticated .env File Exposure via Official Docker Compose Configuration CWE-20 7.5 High 2026-07-16
CVE-2026-63305 AVideo through 29.0 OS Command Injection via ffmpeg.json.php CWE-78 8.1 High 2026-07-16
CVE-2026-63304 AVideo through 29.0 OS Command Injection via listFFmpegProcesses CWE-78 8.1 High 2026-07-16
CVE-2026-54458 AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin CWE-79 9.6 Critical 2026-07-15
CVE-2026-50183 WWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery Section CWE-79 4.7 Medium 2026-07-15
CVE-2026-50182 AVideo Has Unauthenticated Reflected XSS via $_GET['search'] in YouTubeAPI Gallery Pagination CWE-79 6.1 Medium 2026-07-15
CVE-2026-49279 WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass) CWE-79 - - 2026-07-15
CVE-2026-33684 AVideo's Privilege AVideo: Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet Permissions CWE-862 5.3 Medium 2026-07-15
CVE-2026-60092 AVideo - Stored Cross-Site Scripting via Unescaped User-Agent in Participants Panel CWE-79 6.1 Medium 2026-07-08
CVE-2026-56347 AVideo TopMenu Plugin - Stored Cross-Site Scripting via Unescaped Menu Item Fields CWE-79 6.1 Medium 2026-06-20
CVE-2026-56346 AVideo - Unauthenticated PGP Message Decryption via decryptMessage.json.php Endpoint CWE-306 6.5 Medium 2026-06-20
CVE-2026-56345 AVideo - Arbitrary User Session Hijacking via Meet Plugin uploadRecordedVideo Endpoint CWE-287 8.1 High 2026-06-20
CVE-2026-56341 AVideo - Unauthenticated Access to Payment Log DataTables Endpoints via list.json.php CWE-862 7.5 High 2026-06-20

All 344 known CVE vulnerabilities affecting AVideo with full Chinese analysis, references, and POCs where available.