[MEDIUM] AVideo has Unauthenticated IDOR - Playlist Information Disclosure

PKSA-prng-jvqx-4vkt CVE-2026-30885 GHSA-6w2r-cfpc-23r5

Affected version: <25.0

Reported by:
GitHub

[HIGH] AVideo: Unauthenticated PHP session store exposed to host network via published memcached port

PKSA-876z-dgrg-zwqs CVE-2026-29093 GHSA-xxpw-32hf-q8v9

Affected version: <=21.0

Reported by:
GitHub

[CRITICAL] WWBN AVideo is vulnerable to unauthenticated OS Command Injection via base64Url in objects/getImage.php

PKSA-jc43-whmg-bn3y CVE-2026-29058 GHSA-9j26-99jh-v26q

Affected version: <7.0.0

Reported by:
GitHub

[CRITICAL] AVideo has Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction

PKSA-p5zb-45dv-s5gy CVE-2026-28502 GHSA-v8jw-8w5p-23g3

Affected version: <21.0

Reported by:
GitHub

[CRITICAL] AVideo has Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php

PKSA-xtjn-tvnf-r8sj CVE-2026-28501 GHSA-pv87-r9qf-x56p

Affected version: <=21.0.0

Reported by:
GitHub

[HIGH] AVideo has Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.php

PKSA-mpqq-rw7h-r6qr CVE-2026-27732 GHSA-h39h-7cvg-q7j6

Affected version: <=21.0.0

Reported by:
GitHub

[MEDIUM] AVideo has Stored Cross-Site Scripting via Markdown Comment Injection

PKSA-zj1v-1r3y-vnpg CVE-2026-27568 GHSA-rcqw-6466-3mv7

Affected version: <21.0

Reported by:
GitHub

[MEDIUM] AVideo cross-site scripting vulnerability in the view/about.php page

PKSA-m87c-2qr6-rc54 CVE-2024-34899 GHSA-f98p-2hc5-fm7v

Affected version: <14.3

Reported by:
GitHub

[CRITICAL] WWBN AVideo Remote Code Execution

PKSA-1khc-7hwp-86mz CVE-2024-31819 GHSA-mv5w-wr5c-575p

Affected version: >=12.4,<=14.2

Reported by:
GitHub

[MEDIUM] WWBN AVideo recovery notification bypass vulnerability

PKSA-bpdw-n2tk-hn54 CVE-2023-50172 GHSA-8m5f-2xvp-2c8w

Affected version: <=12.4

Reported by:
GitHub

[HIGH] WWBN AVideo Improper Restriction of Excessive Authentication Attempts vulnerability

PKSA-ybsw-d66n-nyf1 CVE-2023-49810 GHSA-v977-h4hm-rrff

Affected version: <=12.4

Reported by:
GitHub

[CRITICAL] WWBN AVideo Insufficient Entropy vulnerbaility

PKSA-c41p-f5f9-8mhz CVE-2023-49599 GHSA-wqcc-qf63-c2x4

Affected version: <=12.4

Reported by:
GitHub

[HIGH] WWBN AVideo command injection vulnerability

PKSA-ws9n-zq9c-9xzs CVE-2023-32073 GHSA-2mhh-27v7-3vcx

Affected version: <=12.4

Reported by:
GitHub

[HIGH] WWBN/AVideo stored XSS vulnerability leads to takeover of any user's account, including admin's account

PKSA-t55s-s47b-sccg CVE-2023-30860 GHSA-xr9h-p2rc-rpqm

Affected version: <12.4

Reported by:
GitHub

[HIGH] Remote code injection in wwbn/avideo

PKSA-ct52-vj4v-3chj CVE-2023-30854 GHSA-6vrj-ph27-qfp3

Affected version: <12.4

Reported by:
GitHub

[HIGH] Cross site scripting (XSS) in wwbn/avideo

PKSA-8k5w-rfw7-6y43 GHSA-2fch-hv74-fgw9

Affected version: <12.4

Reported by:
GitHub

[CRITICAL] AVideo contains Command injection when embedding a video link

PKSA-cgqj-pxkw-3pc8 CVE-2023-25313 GHSA-pgvh-p3g4-86jw

Affected version: <12.4

Reported by:
GitHub

[HIGH] AVideo vulnerable to Improper Privilege Management

PKSA-z1jq-qzpj-5hjc CVE-2020-23489 GHSA-2mgx-226x-8pwv

Affected version: <8.9

Reported by:
GitHub

[MEDIUM] Open redirect in wwbn/avideo

PKSA-yy51-mh2t-n18p CVE-2022-27463 GHSA-34hv-f45p-4qfq

Affected version: <=11.6

Reported by:
GitHub