Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

AVideo — Vulnerabilities & Security Advisories 344

All 344 CVE vulnerabilities found in AVideo, with AI-generated Chinese analysis, references, and POCs.

This page documents security vulnerabilities associated with AVideo, a video management and streaming platform, categorized under weak encryption and access control weaknesses. It aggregates a comprehensive collection of disclosed security issues affecting this specific product, covering historical reports from early releases through the most recent updates identified in the database. By accessing this resource, users can effectively track vendor advisories to stay informed about the latest patches and mitigation strategies released by the developers. The content allows security professionals to understand the prevalence and impact of specific weakness classes within the AVideo ecosystem, facilitating better risk assessment and compliance management. Additionally, researchers and administrators can look up a product's vulnerability history to analyze patterns in defect introduction and resolution over time. This structured view supports informed decision-making regarding upgrade paths and configuration hardening without needing to scour multiple external sources. The data serves as a centralized reference point for identifying known risks, helping organizations prioritize remediation efforts based on severity and exploitability. Whether you are a system administrator ensuring server stability or a security analyst evaluating the supply chain risk, this aggregation provides the necessary context to maintain a secure deployment of AVideo. It bridges the gap between raw CVE data and actionable security intelligence, offering a clear overview of the product's security posture and evolution.

Vendor: WWBN

CVE ID Title CVSS Severity Published
CVE-2026-33683 AVideo vulnerable to Stored XSS via html_entity_decode() Reversing xss_esc() Sanitization in Channel About Field CWE-79 5.4 Medium 2026-03-23
CVE-2026-33681 AVideo has Path Traversal in pluginRunDatabaseScript.json.php Enables Arbitrary SQL File Execution via Unsanitized Plugin Name CWE-22 7.2 High 2026-03-23
CVE-2026-33651 AVideo has a Blind SQL Injection in Live Schedule Reminder via Unsanitized live_schedule_id in Scheduler_commands::getAllActiveOrToRepeat() CWE-89 8.1 High 2026-03-23
CVE-2026-33650 AVideo's Video Moderator Privilege Escalation via Ownership Transfer Enables Arbitrary Video Deletion CWE-863 7.6 High 2026-03-23
CVE-2026-33649 AVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission Modification CWE-352 8.1 High 2026-03-23
CVE-2026-33648 AVideo Vulnerable to OS Command Injection via Unsanitized `users_id` and `liveTransmitionHistory_id` in Restreamer Log File Path CWE-78 8.8 High 2026-03-23
CVE-2026-33647 AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload CWE-434 8.8 High 2026-03-23
CVE-2026-33513 AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP) CWE-22 8.6 High 2026-03-23
CVE-2026-33512 AVideo has an unauthenticated decrypt oracle leaking any ciphertext CWE-287 7.5 High 2026-03-23
CVE-2026-33507 AVideo Affected by CSRF on Plugin Import Endpoint Enables Unauthenticated Remote Code Execution via Malicious Plugin Upload CWE-352 8.8 High 2026-03-23
CVE-2026-33502 AVideo has Unauthenticated SSRF via plugin/Live/test.php CWE-918 9.3 Critical 2026-03-23
CVE-2026-33501 AVideo has Unauthenticated Information Disclosure of User Group Permission Mappings via Permissions Plugin CWE-862 5.3 Medium 2026-03-23
CVE-2026-33500 AVideo Vulnerable to Stored XSS via Markdown `javascript:` URI Bypasses ParsedownSafeWithLinks Sanitization CWE-79 5.4 Medium 2026-03-23
CVE-2026-33499 AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php CWE-79 6.1 Medium 2026-03-23
CVE-2026-33493 AVideo has a Path Traversal in import.json.php that Allows Private Video Theft and Arbitrary File Read/Deletion via fileURI Parameter CWE-22 7.1 High 2026-03-23
CVE-2026-33492 AVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session Regeneration CWE-384 7.3 High 2026-03-23
CVE-2026-33488 AVideo has a PGP 2FA Bypass via Cryptographically Broken 512-bit RSA Key Generation in LoginControl Plugin CWE-326 7.4 High 2026-03-23
CVE-2026-33485 AVideo has an Unauthenticated Blind SQL Injection in RTMP on_publish Callback via Stream Name Parameter CWE-89 7.5 High 2026-03-23
CVE-2026-33483 AVideo Affected by Unauthenticated Disk Space Exhaustion via Unlimited Temp File Creation in aVideoEncoderChunk.json.php CWE-770 7.5 High 2026-03-23
CVE-2026-33482 AVideo has an OS Command Injection via $() Shell Substitution Bypass in sanitizeFFmpegCommand() CWE-78 8.1 High 2026-03-23
CVE-2026-33480 AVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks Proxy CWE-918 8.6 High 2026-03-23
CVE-2026-33479 AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin CWE-94 8.8 High 2026-03-23
CVE-2026-33478 AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection CWE-78 10.0 Critical 2026-03-23
CVE-2026-33354 AVideo has an authenticated arbitrary local file read via `chunkFile` path injection in `aVideoEncoder.json.php` CWE-73 7.6 High 2026-03-23
CVE-2026-33352 AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass) CWE-89 9.8 Critical 2026-03-23
CVE-2026-33351 AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass CWE-918 9.1 Critical 2026-03-23
CVE-2026-33297 AVideo has an IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.php CWE-639 9.1 - 2026-03-23
CVE-2026-33296 AVideo has an Open Redirect via Unvalidated redirectUri in userLogin.php CWE-601 6.1 - 2026-03-22
CVE-2026-33295 AVideo Vulnerable to Stored XSS via Unescaped Video Title in CDN downloadButtons.php CWE-79 5.4 - 2026-03-22
CVE-2026-33294 AVideo has SSRF in BulkEmbed Thumbnail Fetch that Allows Reading Internal Network Resources CWE-918 5.0 Medium 2026-03-22

All 344 known CVE vulnerabilities affecting AVideo with full Chinese analysis, references, and POCs where available.