WordPress AudioIgniter <= 2.0.2 - Unauthenticated IDOR

The AudioIgniter plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. The handleplaylistendpoint function accepted a user-controlled playlist ID and returned track data without authentication. id: CVE-2026-8679 info: name: WordPress...

CVE-2010-1872-BlazeDVD-SEH-Exploit

BlazeDVD 5.0 - '.PLF' Playlist SEH Buffer Overflow Exploit CVE-2010-1872 Proof-of-Concept PoC exploit targeting a buffer overflow vulnerability in BlazeDVD version 5.0 via a crafted .plf playlist file. The exploit uses SEH Structured Exception Handler overwrite to achieve code execution. Details...

CVE-2026-90552

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate playlist ownership in the Playlists_schedules/list.json.php and Live/calendar.json.php endpoints. This missing authorization check allows both authenticated users with canStream privileges and unauthenticated us...

EUVD-2026-76870

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate playlist ownership in the Playlistsschedules/list.json.php and Live/calendar.json.php endpoints, allowing authenticated and unauthenticated users to read private playlist schedule metadata. Attackers with...

CVE-2026-90551

WWBN AVideo (through commit c3edcc274) has a missing authorization flaw in its video_from_program API endpoint, which fails to validate playlist ownership before returning results. An unauthenticated network attacker can query the endpoint to enumerate private playlist names, owner information, a...

EUVD-2026-76869

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate playlist ownership in the videofromprogram API endpoint, allowing unauthenticated access to private playlist contents. Attackers can query the API without authentication to enumerate private playlist names, owne...

CVE-2026-90540

WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) contains a missing authorization flaw in the playListAddVideo.json.php endpoint. The endpoint fails to validate watch permissions when adding videos to playlists, allowing authenticated attackers to add password-protected video...

EUVD-2026-76858

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate watch permissions in the playListAddVideo.json.php endpoint when adding videos to playlists. Authenticated attackers can add password-protected videos they cannot watch to playlists they own by submitting the...

CVE-2026-89245

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in playlistRemove.php that allows attackers to delete playlists by skipping CSRF protection checks. Attackers can craft a malicious form that submits a POST request to...

CVE-2026-89245 WWBN AVideo Cross-Site Request Forgery via playlistRemove.php

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in playlistRemove.php that allows attackers to delete playlists by skipping CSRF protection checks. Attackers can craft a malicious form that submits a POST request to...

CVE-2026-89245

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery (CSRF) vulnerability in playlistRemove.php . The root cause is that CSRF protection checks can be bypassed, allowing an attacker to craft a malicious form that submits a POST request to the e...

EUVD-2026-76057

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in playlistRemove.php that allows attackers to delete playlists by skipping CSRF protection checks. Attackers can craft a malicious form that submits a POST request to...

CVE-2009-0182

VUPlayer 2.49 Local Buffer Overflow to Arbitrary Code Execution Program Version: VUPlayer 2.49 Vulnerability: local buffer overflow when importing .wax playlist file that will lead to arbitrary code execution Exploitation: Local Buffer Overflow CVE: CVE-2009-0182 VUPlayer2.49poc.py : without bypa...

EUVD-2026-69023

AVideo contains a cross-site request forgery vulnerability in plugin/API/set.json.php that allows attackers to perform state-changing actions by crafting GET requests that bypass CSRF protection. Attackers can navigate a victim's browser to a malicious URL with API parameters to delete videos,...

CVE-2026-83595 AVideo Cross-Site Request Forgery via plugin/API/set.json.php

AVideo contains a cross-site request forgery vulnerability in plugin/API/set.json.php that allows attackers to perform state-changing actions by crafting GET requests that bypass CSRF protection. Attackers can navigate a victim's browser to a malicious URL with API parameters to delete videos,...

Astra Linux – Vulnerability in ffmpeg, ffmpeg5

A flaw was discovered in FFmpeg’s DASH playlist support. This vulnerability allows for arbitrary HTTP GET requests to be made on behalf of the machine running FFmpeg, through a crafted DASH playlist containing malicious URLs...

Astra Linux – Vulnerability in ffmpeg

A flaw was discovered in FFmpeg’s HLS playlist parsing. This vulnerability allows for a denial of service through a maliciously crafted HLS playlist, which triggers a null pointer dereference during initialization...

SUSE CVE-2026-49338

gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, the Subsonic API endpoints /rest/deletePlaylist.view and /rest/getPlaylist.view perform no per-resource authorization. Once authenticated as any user admin or not, an attacker can delete...

SUSE CVE-2026-49340

gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, a logic error in ServeCreateOrUpdatePlaylist allows any authenticated Subsonic user including non-admin to write playlist M3U content to an attacker-controlled absolute filesystem path o...

EUVD-2026-46408

MediaCMS 8.2.0 contains an information disclosure vulnerability that allows authenticated users to expose private media metadata belonging to other users by adding arbitrary media tokens to their own playlist without access control checks. Attackers can issue a PUT request to the playlist API...