wwbn/avideo vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-33683Mediumwwbn/avideo: AVideo vulnerable to Stored XSS via html_entity_decode() Reversing xss_esc() Sanitization in Channel About Field CVE-2026-33681Highwwbn/avideo: AVideo has Path Traversal in pluginRunDatabaseScript.json.php Enables Arbitrary SQL File Execution via Unsanitized Plugin Name CVE-2026-33651Highwwbn/avideo: AVideo has a Blind SQL Injection in Live Schedule Reminder via Unsanitized live_schedule_id in Scheduler_commands::getAllActiveOrToRepeat()CVE-2026-33650Highwwbn/avideo: AVideo: Video Moderator Privilege Escalation via Ownership Transfer Enables Arbitrary Video Deletion CVE-2026-33649Highwwbn/avideo: AVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission Modification CVE-2026-33648Highwwbn/avideo: AVideo Vulnerable to OS Command Injection via Unsanitized `users_id` and `liveTransmitionHistory_id` in Restreamer Log File Path CVE-2026-33647Highwwbn/avideo: AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload CVE-2026-33513Highwwbn/avideo: AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP)CVE-2026-33512Highwwbn/avideo: AVideo has an unauthenticated decrypt oracle leaking any ciphertext CVE-2026-33507Highwwbn/avideo: AVideo Affected by CSRF on Plugin Import Endpoint Enables Unauthenticated Remote Code Execution via Malicious Plugin Upload CVE-2026-33502Criticalwwbn/avideo: AVideo has Unauthenticated SSRF via plugin/Live/test.php CVE-2026-33501Mediumwwbn/avideo: AVideo has Unauthenticated Information Disclosure of User Group Permission Mappings via Permissions Plugin CVE-2026-33500Mediumwwbn/avideo: AVideo - Incomplete Fix for CVE-2026-27568: Stored XSS via Markdown `javascript:` URI Bypasses ParsedownSafeWithLinks Sanitization CVE-2026-33499Mediumwwbn/avideo: AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php CVE-2026-33493Highwwbn/avideo: AVideo has a Path Traversal in import.json.php Allows Private Video Theft and Arbitrary File Read/Deletion via fileURI Parameter CVE-2026-33492Highwwbn/avideo: AVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session Regeneration CVE-2026-33488Highwwbn/avideo: AVideo has a PGP 2FA Bypass via Cryptographically Broken 512-bit RSA Key Generation in LoginControl Plugin CVE-2026-33485Highwwbn/avideo: AVideo has an Unauthenticated Blind SQL Injection in RTMP on_publish Callback via Stream Name Parameter CVE-2026-33483Highwwbn/avideo: AVideo Affected by Unauthenticated Disk Space Exhaustion via Unlimited Temp File Creation in aVideoEncoderChunk.json.php CVE-2026-33482Highwwbn/avideo: AVideo has an OS Command Injection via $() Shell Substitution Bypass in sanitizeFFmpegCommand()CVE-2026-33480Highwwbn/avideo: AVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks Proxy CVE-2026-33479Highwwbn/avideo: AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin CVE-2026-33478Criticalwwbn/avideo: AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection CVE-2026-33354Highwwbn/avideo: AVideo has an authenticated arbitrary local file read via `chunkFile` path injection in `aVideoEncoder.json.php`CVE-2026-33352Criticalwwbn/avideo: AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo