CVE-2023-30854

WWBN Avideo Authenticated RCE - OS Command Injection CVE-2023-30854 WWBN Avideo sqlFile $objClone-cloneSiteURLvideos/cache/clones/$json-sqlFile"; $log-add"Clone 2 of $totalSteps: Geting MySQL Dump file"; exec$cmd . " 2&1", $output, $returnval; We can control $objClone-cloneSiteURL through the adm...

CVE-2026-126809

WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in objects/import.json.php that allows uploaders to import other users' MP4 files by referencing any folder under videos/. Attackers can copy private, unlisted, password-protected or pay-per-view videos, read victims'...

CVE-2026-126810

WWBN AVideo 29.1.0 through 29.7.1 contains a stored cross-site scripting vulnerability that allows registered users to inject markup through the channel About field rendered in feed/index.php. Attackers can store an unquoted event-handler payload that bypasses feedHtmlDescription filtering and...

CVE-2026-126804

WWBN AVideo 12.4 through 29.7.1 contains a path traversal vulnerability in the ADs plugin deleteImage.json.php that allows authenticated users with custom ads to delete arbitrary files. Attackers can set the unvalidated isregularuser parameter to another user's id or ../ sequences to delete other...

CVE-2026-126806

WWBN AVideo 14.3 through 29.7.1 contains a stored cross-site scripting vulnerability that allows uploaders to inject scripts via the videoDownloadedLink value stored unescaped through objects/aVideoEncoder.json.php. Attackers can embed event-handler payloads in the URL host rendered as a Source t...

CVE-2026-126805

WWBN AVideo through 29.7.1 contains an incorrect authorization vulnerability that allows delegated Videos Admin users to obtain videoidhash values bound to any video owner via encoder endpoints like aVideoEncoderStatus.json.php. Attackers can request the hash for an administrator-owned video and...

EUVD-2026-124025

WWBN AVideo 29.1.0 through 29.7.1 contains a stored cross-site scripting vulnerability that allows registered users to inject markup through the channel About field rendered in feed/index.php. Attackers can store an unquoted event-handler payload that bypasses feedHtmlDescription filtering and...

CVE-2026-126810

WWBN AVideo versions 29.1.0 through 29.7.1 are vulnerable to a stored cross-site scripting (XSS) vulnerability. The issue resides in the channel About field rendered in feed/index.php . Registered users can inject markup that bypasses the feedHtmlDescription() filtering by using an unquoted event...

CVE-2026-126810 WWBN AVideo 29.1.0 through 29.7.1 Stored XSS via Channel RSS Feed

WWBN AVideo 29.1.0 through 29.7.1 contains a stored cross-site scripting vulnerability that allows registered users to inject markup through the channel About field rendered in feed/index.php. Attackers can store an unquoted event-handler payload that bypasses feedHtmlDescription filtering and...

CVE-2026-126810

WWBN AVideo 29.1.0 through 29.7.1 contains a stored cross-site scripting vulnerability that allows registered users to inject markup through the channel About field rendered in feed/index.php. Attackers can store an unquoted event-handler payload that bypasses feedHtmlDescription filtering and...

CVE-2026-126809 WWBN AVideo through 29.7.1 Missing Authorization via objects/import.json.php

WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in objects/import.json.php that allows uploaders to import other users' MP4 files by referencing any folder under videos/. Attackers can copy private, unlisted, password-protected or pay-per-view videos, read victims'...

CVE-2026-126809

WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in objects/import.json.php that allows uploaders to import other users' MP4 files by referencing any folder under videos/. Attackers can copy private, unlisted, password-protected or pay-per-view videos, read victims'...

EUVD-2026-124024

WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in objects/import.json.php that allows uploaders to import other users' MP4 files by referencing any folder under videos/. Attackers can copy private, unlisted, password-protected or pay-per-view videos, read victims'...

CVE-2026-126809

The WWBN AVideo software (versions through 29.7.1 ) contains a missing authorization vulnerability within the objects/import.json.php component. This flaw allows authenticated uploaders to import MP4 files belonging to other users by referencing any folder under videos/. Exploitation of this vuln...

CVE-2026-126806 WWBN AVideo 14.3 through 29.7.1 Stored XSS via Video Source Tag

WWBN AVideo 14.3 through 29.7.1 contains a stored cross-site scripting vulnerability that allows uploaders to inject scripts via the videoDownloadedLink value stored unescaped through objects/aVideoEncoder.json.php. Attackers can embed event-handler payloads in the URL host rendered as a Source t...

CVE-2026-126806

WWBN AVideo 14.3 through 29.7.1 contains a stored cross-site scripting vulnerability that allows uploaders to inject scripts via the videoDownloadedLink value stored unescaped through objects/aVideoEncoder.json.php. Attackers can embed event-handler payloads in the URL host rendered as a Source t...

EUVD-2026-124020

WWBN AVideo through 29.7.1 contains an incorrect authorization vulnerability that allows delegated Videos Admin users to obtain videoidhash values bound to any video owner via encoder endpoints like aVideoEncoderStatus.json.php. Attackers can request the hash for an administrator-owned video and...

CVE-2026-126806

WWBN AVideo versions 14.3 through 29.7.1 are vulnerable to a stored cross-site scripting (XSS) flaw. The issue arises because the videoDownloadedLink value is stored unescaped via objects/aVideoEncoder.json.php. Attackers can inject scripts by embedding event-handler payloads in the URL host, whi...

CVE-2026-126805

WWBN AVideo through 29.7.1 contains an incorrect authorization vulnerability that allows delegated Videos Admin users to obtain videoidhash values bound to any video owner via encoder endpoints like aVideoEncoderStatus.json.php. Attackers can request the hash for an administrator-owned video and...

EUVD-2026-124021

WWBN AVideo 14.3 through 29.7.1 contains a stored cross-site scripting vulnerability that allows uploaders to inject scripts via the videoDownloadedLink value stored unescaped through objects/aVideoEncoder.json.php. Attackers can embed event-handler payloads in the URL host rendered as a Source t...