CVE-2025-34438 AVideo < 20.1 IDOR Arbitrary Video Rotation

AVideo versions prior to 20.1 contain an insecure direct object reference vulnerability allowing users with upload permissions to modify the rotation metadata of any video. The endpoint verifies upload capability but fails to enforce ownership or management rights for the targeted video...

CVE-2025-34435 AVideo < 20.1 IDOR Arbitrary File Deletion

AVideo versions prior to 20.1 are vulnerable to an insecure direct object reference IDOR that allows any authenticated user to delete media files belonging to other users. The affected endpoint validates authentication but fails to verify ownership or edit permissions for the targeted video...

CVE-2025-34435 AVideo < 20.1 IDOR Arbitrary File Deletion

AVideo versions prior to 20.1 are vulnerable to an insecure direct object reference IDOR that allows any authenticated user to delete media files belonging to other users. The affected endpoint validates authentication but fails to verify ownership or edit permissions for the targeted video...

EUVD-2025-203952

AVideo versions prior to 20.0 allow any authenticated user to upload files into directories belonging to other users due to an insecure direct object reference. The upload functionality verifies authentication but does not enforce ownership checks...

CVE-2025-34441 AVideo < 20.1 User Information Disclosure via Public API

AVideo versions prior to 20.1 expose sensitive user information through an unauthenticated public API endpoint. Responses include emails, usernames, administrative status, and last login times, enabling user enumeration and privacy violations...

PT-2025-51887

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 20.1 Description AVideo versions prior to 20.1 are susceptible to an insecure direct object reference IDOR that permits any authenticated user to delete media files owned by other users. The affected endpoint confirms...

AVideo 安全漏洞

AVideo is an open source broadcast network creation tool from World Wide Broadcast Network. A security vulnerability exists in AVideo versions prior to 20.0, which stems from a lack of ownership checks on endpoints, and could lead to authenticated users uploading comment images to other users'...

EUVD-2025-37959

ClipBucket v5 is an open source video sharing platform. Versions 5.5.2 - 151 and below allow authenticated administrators with plugin management privileges to execute arbitrary SQL commands against the database through its ClipBucket Custom Fields plugin. The vulnerabilities require the Custom...

EUVD-2024-55036

Huijietong Cloud Video Platform contains a path traversal vulnerability that allows an unauthenticated attacker can supply arbitrary file paths to the fullPath parameter of the /fileDownload?action=downloadBackupFile endpoint and retrieve files from the server filesystem. VulnCheck has observed...

CVE-2024-13991 Huijietong Cloud Video Platform fileDownload Arbitrary File Read

Huijietong Cloud Video Platform contains a path traversal vulnerability that allows an unauthenticated attacker can supply arbitrary file paths to the fullPath parameter of the /fileDownload?action=downloadBackupFile endpoint and retrieve files from the server filesystem. VulnCheck has observed...

Malicious Package

Overview @video-platform/core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2025-6357 Malicious code in @video-platform/react-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ea452d0cbf0922cb64aa58841819736049f66b68af3431da448a1703d4261e6d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WWBN AVideo 竞争条件问题漏洞

WWBN AVideo is a video platform builder written in PHP by WWBN team. A competitive condition issue vulnerability exists in WWBN AVideo version 14.4, which stems from a competitive condition in the aVideoEncoder.json.php decompression function that could lead to arbitrary code execution...

WWBN AVideo 跨站脚本漏洞

WWBN AVideo is a video platform builder written in PHP by the WWBN team. A cross-site scripting vulnerability exists in WWBN AVideo version 14.4, which stems from the LoginWordPress loginForm cancelUri parameter could lead to a cross-site scripting attack...

WWBN AVideo 安全漏洞

WWBN AVideo is a video platform builder written in PHP by the WWBN team. A security vulnerability exists in WWBN AVideo version 14.4, which stems from the presence of an incomplete blacklist in the .htaccess sample and could lead to the execution of arbitrary code...

Kaltura Video Platform 安全漏洞

Kaltura Video Platform is a video management and distribution platform from Kaltura Individual Developers in the United States. A security vulnerability exists in Kaltura Video Platform versions prior to 11.1.0-2, which stems from insecure deserialization and could lead to remote code execution...

CVE-2021-21738

ZTE's big video business platform has two reflective cross-site scripting XSS vulnerabilities. Due to insufficient input verification, the attacker could implement XSS attacks by tampering with the parameters, to affect the operations of valid users. This affects:...

Logic flaw vulnerability in H5S video platform of ZeroVision Technology (Shanghai) Co.

ZeroVision Technology Shanghai Co., Ltd. is an enterprise mainly engaged in software and information technology service industry. ZeroVision Technologies Shanghai Ltd. H5S video platform has a logic flaw vulnerability that can be exploited by attackers to obtain sensitive information and create...

WEB VIDEO PLATFORM Security Vulnerabilities

WEB VIDEO PLATFORM is a WVP-PRO open source out-of-the-box web video platform implemented based on the GB28181-2016 standard. A security vulnerability exists in WEB VIDEO PLATFORM GB28181 Pro version 2.0, which stems from an access control issue that allows an authenticated attacker to elevate...

WEB VIDEO PLATFORM Security Vulnerabilities

WEB VIDEO PLATFORM is a WVP-PRO open source out-of-the-box web video platform implemented based on the GB28181-2016 standard. A security vulnerability exists in WEB VIDEO PLATFORM GB28181 Pro version 2.0, which stems from a user continuing to access information in the application after deleting...