Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1310 CNY

100%

AVideo — Vulnerabilities & Security Advisories 193

All 193 CVE vulnerabilities found in AVideo, with AI-generated Chinese analysis, references, and POCs.

This page is a comprehensive vulnerability aggregation resource for AVideo, focusing on common weakness enumeration tags associated with the platform. It collects and organizes detailed reports on security flaws, including cross-site scripting, SQL injection, path traversal, and authentication bypass issues discovered within the AVideo software ecosystem. The data spans from the initial public disclosure of early vulnerabilities through to the most recent patches released by the vendor, ensuring a complete historical record of security incidents. By navigating this collection, security professionals and administrators can efficiently track the vendor’s advisory timeline to understand the pace and nature of remediation efforts. Users can also delve into the specifics of particular weakness classes to analyze attack vectors and mitigation strategies relevant to AVideo deployments. Additionally, the page serves as a lookup tool for reviewing a specific product version’s vulnerability history, helping teams assess risk exposure and prioritize updates based on past incident patterns. This centralized view facilitates informed decision-making for system hardening and compliance audits without requiring searches across multiple disparate sources. The information is presented to support proactive security management, allowing teams to anticipate potential threats and apply appropriate controls effectively. All entries are curated to provide accurate technical context, enabling deeper analysis of how specific defects impact the overall security posture of the application. This resource aims to reduce the time spent on information gathering, thereby accelerating the response to emerging security challenges in environments utilizing AVideo.

Vendor: WWBN

CVE IDTitleCVSSSeverityPublished
CVE-2026-45580 WWBN AVideo Live: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute CWE-79 5.4 Medium2026-05-29
CVE-2026-45578 WWBN AVideo Live: OS command injection in on_publish.php execAsync via unescaped m3u8 URL CWE-78 8.8 High2026-05-29
CVE-2026-45610 WWBN AVideo plugin/LoginControl/set.json.php: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA CWE-306 5.7 Medium2026-05-29
CVE-2026-45619 AVideo CVE-2026-43884 incomplete fix - `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD post CWE-367 6.5 Medium2026-05-29
CVE-2026-45620 AVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumeration CWE-204 5.3 Medium2026-05-29
CVE-2026-45731 WWBN AVideo: Authenticated Arbitrary File Read in view/update.php CWE-22--2026-05-29
CVE-2026-46337 WWBN AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php` CWE-22--2026-05-29
CVE-2026-47694 WWBN AVideo: Stored XSS via unescaped Gallery category description CWE-79 5.4 Medium2026-05-29
CVE-2026-47696 WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint CWE-345--2026-05-29
CVE-2026-43885 WWBN AVideo: Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization CWE-200--2026-05-11
CVE-2026-43884 WWBN AVideo: SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL() CWE-918 7.7 High2026-05-11
CVE-2026-43883 WWBN AVideo: IDOR in PayPalYPT agreementCancel.json.php Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription Agreements CWE-639 4.2 Medium2026-05-11
CVE-2026-43882 WWBN AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event Spoofing CWE-93 4.3 Medium2026-05-11
CVE-2026-43881 WWBN AVideo: Unauthenticated User Enumeration in `objects/users.json.php` via `isCompany` Parameter Flips `$ignoreAdmin = true` and Defeats Admin-Only Listing Guard CWE-306 5.3 Medium2026-05-11
CVE-2026-43880 WWBN AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Allows Phishing from Site's Legitimate From Address CWE-940 5.3 Medium2026-05-11
CVE-2026-43879 WWBN AVideo: Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT_FOLLOWLOCATION Redirect Bypass CWE-918 5.4 Medium2026-05-11
CVE-2026-43878 WWBN AVideo: Reflected XSS in plugin/Meet/iframe.php via Unescaped `user`/`pass` Parameters Reflected into JavaScript String Literal CWE-79 6.1 Medium2026-05-11
CVE-2026-43877 WWBN AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Any Logged-in User's Profile Photo with Arbitrary Bytes CWE-352 5.4 Medium2026-05-11
CVE-2026-43876 WWBN AVideo: HTML Injection in notifySubscribers.json.php Enables Platform-Branded Phishing Emails to Channel Subscribers CWE-79 6.4 Medium2026-05-11
CVE-2026-43875 WWBN AVideo: Password Hash Leaked in MobileManager OAuth Redirect URL Enables Account Takeover CWE-598 6.8 Medium2026-05-11
CVE-2026-43873 WWBN AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone Server CWE-209 7.5 High2026-05-11
CVE-2026-43874 WWBN AVideo: Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']` Relay Bypass CWE-94 7.2 High2026-05-11
CVE-2026-41304 WWBN AVideo vulnerable to RCE caused by clonesite plugin CWE-77 8.8AIHighAI2026-04-21
CVE-2026-41064 AVideo has an incomplete fix for CVE-2026-33502 (Command Injection) CWE-78 9.3 Critical2026-04-21
CVE-2026-41063 WWBN AVideo has incomplete fix for CVE-2026-33500 (XSS) CWE-79 5.4 Medium2026-04-21
CVE-2026-41062 WWBN/AVideo has an incomplete fix for a directory traversal bypass via query string in ReceiveImage downloadURL parameters CWE-22 6.5 Medium2026-04-21
CVE-2026-41061 WWBN AVideo Vulnerable to stored XSS via Unanchored Duration Regex in Video Encoder Receiver CWE-79 5.4 Medium2026-04-21
CVE-2026-41060 AVideo's SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL CWE-918 7.7 High2026-04-21
CVE-2026-41058 AVideo has an incomplete fix for CVE-2026-33293 (Path Traversal) in AVideo CWE-22 8.1 High2026-04-21
CVE-2026-41057 AVideo has CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) that Exposes Authenticated API Responses CWE-346 7.1 High2026-04-21

All 193 known CVE vulnerabilities affecting AVideo with full Chinese analysis, references, and POCs where available.