CVE-2026-61575

The AVideo video-sharing platform is vulnerable to stored DOM cross-site scripting (XSS) in versions prior to 8.1.0 . The root cause lies in view/queue.php, where the pathinfo function processes a caller-controlled fileURI and stores the resulting filename in encoder_queue.title without neutraliz...

CVE-2026-61575 AVideo-Encoder vulnerable to stored DOM cross-site scripting through queue titles

AVideo is a video-sharing Platform. Prior to 8.1.0, view/queue.php uses pathinfo on the caller-controlled fileURI and stores its filename through setTitle in encoderqueue.title without neutralization. fileURI is not in the objects/security.php filter lists, and the Login::canUpload capability...

CVE-2026-61571 AVideo-Encoder: missing authentication on control and status endpoints

AVideo is a video-sharing Platform. Prior to 8.1.0, the encoder lacks a global authentication layer and exposes control and status PHP endpoints to anonymous network callers. view/run.php has a commented-out guard and invokes Encoder::run. view/queue.json.php calls Encoder::getAlltrue, reveals...

CVE-2026-61571 AVideo-Encoder: missing authentication on control and status endpoints

AVideo is a video-sharing Platform. Prior to 8.1.0, the encoder lacks a global authentication layer and exposes control and status PHP endpoints to anonymous network callers. view/run.php has a commented-out guard and invokes Encoder::run. view/queue.json.php calls Encoder::getAlltrue, reveals...

CVE-2026-61571 AVideo-Encoder: missing authentication on control and status endpoints

AVideo is a video-sharing Platform. Prior to 8.1.0, the encoder lacks a global authentication layer and exposes control and status PHP endpoints to anonymous network callers. view/run.php has a commented-out guard and invokes Encoder::run. view/queue.json.php calls Encoder::getAlltrue, reveals...

CVE-2026-61571

The AVideo video-sharing platform encoder is vulnerable to missing authentication in versions prior to 8.1.0 . The lack of a global authentication layer exposes several PHP endpoints to anonymous network callers. Specifically, view/run.php invokes Encoder::run() without a guard, while view/queue....

CVE-2026-61567 AVideo-Encoder: unauthenticated command execution through streamer login trust

AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint view/videosListToLive.php accepts an attacker-named streamer in webSiteRootURL, calls Login::run in objects/Login.php, and trusts the returned JSON as session state. An unauthenticated remote attacker who can host an...

CVE-2026-61567 AVideo-Encoder: unauthenticated command execution through streamer login trust

AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint view/videosListToLive.php accepts an attacker-named streamer in webSiteRootURL, calls Login::run in objects/Login.php, and trusts the returned JSON as session state. An unauthenticated remote attacker who can host an...

CVE-2026-61567

AVideo, a video-sharing platform, contains a critical vulnerability in the view/videosListToLive.php endpoint prior to version 8.1.0 . An unauthenticated remote attacker can self-grant isLogged and canStream status by providing a controlled webSiteRootURL, as the system trusts the returned JSON a...

World Wide Broadcast Network AVideo-Encoder code injection vulnerability

Versions prior to AVideo-Encoder 8.1.0 of the World Wide Broadcast Network contain a code injection vulnerability. This vulnerability arises because the unauthenticated installer endpoint install/checkConfiguration.php fails to escape request parameters when inserting them into single-quoted PHP...

CVE-2026-61571: WWBN AVideo-Encoder: AVideo is a video-sharing Platform

AVideo is a video-sharing Platform. Prior to 8.1.0, the encoder lacks a global authentication layer and exposes control and status PHP endpoints to anonymous network callers. view/run.php has a commented-out guard and invokes Encoder::run. view/queue.json.php calls Encoder::getAlltrue, reveals...

World Wide Broadcast Network AVideo-Encoder SQL injection vulnerability

Versions prior to AVideo-Encoder 8.1.0 of the World Wide Broadcast Network contain an SQL injection vulnerability. This vulnerability arises because unauthenticated streamers log user parameters without proper parameterization or escaping into MariaDB queries. As a result, attackers may exploit...

World Wide Broadcast Network AVideo-Encoder authorization issue vulnerability

Versions prior to AVideo-Encoder 8.1.0 of the World Wide Broadcast Network contain an authorization issue vulnerability. This vulnerability stems from the encoder lacking a global authentication layer; the view/run.php file is protected via comments and calls Encoder::run. view/queue.json.php...

CVE-2026-61575: WWBN AVideo-Encoder: AVideo is a video-sharing Platform

AVideo is a video-sharing Platform. Prior to 8.1.0, view/queue.php uses pathinfo on the caller-controlled fileURI and stores its filename through setTitle in encoderqueue.title without neutralization. fileURI is not in the objects/security.php filter lists, and the Login::canUpload capability...

World Wide Broadcast Network AVideo-Encoder Cross-site Scripting Vulnerability

Versions prior to AVideo-Encoder 8.1.0 of the World Wide Broadcast Network contain a cross-site scripting vulnerability. This vulnerability arises because view/queue.php utilizes pathinfo when handling fileURI values controlled by callers. Additionally, setTitle is used to store filenames without...

CVE-2026-61567: WWBN AVideo-Encoder: AVideo is a video-sharing Platform

AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint view/videosListToLive.php accepts an attacker-named streamer in webSiteRootURL, calls Login::run in objects/Login.php, and trusts the returned JSON as session state. An unauthenticated remote attacker who can host an...

World Wide Broadcast Network AVideo-Encoder command injection vulnerability

Versions prior to AVideo-Encoder 8.1.0 of the World Wide Broadcast Network contain a command injection vulnerability. This vulnerability arises because the live streaming endpoint view/videosListToLive.php trusts the webSiteRootURL and the JSON session state returned during login. The video list...

CVE-2026-61569: WWBN AVideo-Encoder: AVideo is a video-sharing Platform

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated streamer login at objects/login.json.php passes the user parameter to Streamer::get in objects/Streamer.php, where it is interpolated into a single-quoted MariaDB SELECT without parameterization or escaping. Although...

World Wide Broadcast Network AVideo-Encoder Cross-site Scripting Vulnerability

Versions prior to AVideo-Encoder 8.1.0 of the World Wide Broadcast Network contain a cross-site scripting vulnerability. This vulnerability arises because the anonymous login interface fails to properly encode request values such as webSiteRootURL, user, pass, and POST lang within view/index.php,...

World Wide Broadcast Network AVideo-Encoder server request forgery vulnerability

Versions prior to AVideo-Encoder 8.1.0 of the World Wide Broadcast Network contain a server-side request forgery vulnerability. This vulnerability arises because urlgetcontents in objects/functions.php performs only syntactic validation on URLs controlled by callers; it fails to reject private,...