Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

AVideo — Vulnerabilities & Security Advisories 344

All 344 CVE vulnerabilities found in AVideo, with AI-generated Chinese analysis, references, and POCs.

This page documents security vulnerabilities associated with AVideo, a video management and streaming platform, categorized under weak encryption and access control weaknesses. It aggregates a comprehensive collection of disclosed security issues affecting this specific product, covering historical reports from early releases through the most recent updates identified in the database. By accessing this resource, users can effectively track vendor advisories to stay informed about the latest patches and mitigation strategies released by the developers. The content allows security professionals to understand the prevalence and impact of specific weakness classes within the AVideo ecosystem, facilitating better risk assessment and compliance management. Additionally, researchers and administrators can look up a product's vulnerability history to analyze patterns in defect introduction and resolution over time. This structured view supports informed decision-making regarding upgrade paths and configuration hardening without needing to scour multiple external sources. The data serves as a centralized reference point for identifying known risks, helping organizations prioritize remediation efforts based on severity and exploitability. Whether you are a system administrator ensuring server stability or a security analyst evaluating the supply chain risk, this aggregation provides the necessary context to maintain a secure deployment of AVideo. It bridges the gap between raw CVE data and actionable security intelligence, offering a clear overview of the product's security posture and evolution.

Vendor: WWBN

CVE ID Title CVSS Severity Published
CVE-2026-41057 AVideo has CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) that Exposes Authenticated API Responses CWE-346 7.1 High 2026-04-21
CVE-2026-41056 AVideos has CORS Origin Reflection with Credentials on Sensitive API Endpoints that Enables Cross-Origin Account Takeover CWE-942 8.1 High 2026-04-21
CVE-2026-41055 AVideo has an incomplete fix for CVE-2026-33039 (SSRF) CWE-918 8.6 High 2026-04-21
CVE-2026-40935 WWBN/AVideo has CAPTCHA Bypass via Attacker-Controlled Length Parameter and Missing Token Invalidation on Failure CWE-804 5.3 Medium 2026-04-21
CVE-2026-40929 WWBN AVideo's missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creators CWE-352 5.4 Medium 2026-04-21
CVE-2026-40928 AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset Deletion CWE-352 5.4 Medium 2026-04-21
CVE-2026-40926 WWBN AVideo Vulnerable to CSRF in Admin JSON Endpoints (Category CRUD, Plugin Update Script) CWE-352 7.1 High 2026-04-21
CVE-2026-40925 WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials CWE-352 8.3 High 2026-04-21
CVE-2026-40911 WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks CWE-94 10.0 Critical 2026-04-21
CVE-2026-40909 WWBN AVideo has a Path Traversal in Locale Save Endpoint that Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE) CWE-22 8.7 High 2026-04-21
CVE-2026-40908 WWBN AVideo has an Unauthenticated Information Disclosure via git.json.php that Exposes Developer Emails and Deployed Version CWE-200 5.3 Medium 2026-04-21
CVE-2026-40907 WWBN AVideo has IDOR in Live Restreams list.json.php that Exposes Other Users' Stream Keys and OAuth Tokens CWE-639 6.5 Medium 2026-04-21
CVE-2026-39370 WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration (Incomplete fix for CVE-2026-27732) CWE-918 7.1 High 2026-04-07
CVE-2026-39369 WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLs CWE-22 7.6 High 2026-04-07
CVE-2026-39368 WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services CWE-918 6.5 Medium 2026-04-07
CVE-2026-39367 WWBN AVideo has Stored XSS via Malicious EPG XML Program Titles in AVideo EPG Page CWE-79 5.4 Medium 2026-04-07
CVE-2026-39366 WWBN AVideo Affected by a PayPal IPN Replay Attack Enabling Wallet Balance Inflation via Missing Transaction Deduplication in ipn.php CWE-345 6.5 Medium 2026-04-07
CVE-2026-35452 WWBN AVideo has Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php CWE-200 5.3 Medium 2026-04-06
CVE-2026-35450 WWBN AVideo has Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php CWE-306 5.3 Medium 2026-04-06
CVE-2026-35449 WWBN AVideo has Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.php CWE-200 5.3 Medium 2026-04-06
CVE-2026-35448 WWBN AVideo Provides Unauthenticated Access to Payment Order Data via BlockonomicsYPT check.php CWE-862 3.7 Low 2026-04-06
CVE-2026-35181 WWBN AVideo Affected by CSRF on Player Skin Configuration via admin/playerUpdate.json.php CWE-352 4.3 Medium 2026-04-06
CVE-2026-35180 WWBN AVideo affected by CSRF on Site Customization Endpoint Enables Logo Overwrite via Base64 File Write CWE-352 4.3 Medium 2026-04-06
CVE-2026-35179 WWBN AVideo Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php CWE-862 5.3 Medium 2026-04-06
CVE-2026-34740 AVideo: Stored SSRF via Video EPG Link Missing isSSRFSafeURL() Validation CWE-918 6.5 Medium 2026-03-31
CVE-2026-34739 AVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.php CWE-79 6.1 Medium 2026-03-31
CVE-2026-34738 AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter CWE-285 4.3 Medium 2026-03-31
CVE-2026-34737 AVideo: Arbitrary Stripe Subscription Cancellation via Debug Endpoint and retrieveSubscriptions() Bug CWE-862 6.5 Medium 2026-03-31
CVE-2026-34733 AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard CWE-284 6.5 Medium 2026-03-31
CVE-2026-34732 AVideo: Missing Authentication in CreatePlugin list.json.php Template Affects 21 Endpoints CWE-306 5.3 Medium 2026-03-31

All 344 known CVE vulnerabilities affecting AVideo with full Chinese analysis, references, and POCs where available.