15 matches found
EUVD-2026-76068
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the Bookmark plugin where chapter names are not encoded before being concatenated into public watch-page HTML. A video owner can inject malicious scripts via the bookmark name...
CVE-2026-89256 AVideo Bookmark Plugin Stored XSS via Chapter Names
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the Bookmark plugin where chapter names are not encoded before being concatenated into public watch-page HTML. A video owner can inject malicious scripts via the bookmark name...
CVE-2026-89256
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is affected by a stored cross-site scripting (XSS) vulnerability in its Bookmark plugin . The root cause is that chapter names are not HTML-encoded before being concatenated into public watch-page markup. A video owner can inject a ma...
CVE-2026-89253 AVideo Stored XSS via donationLink in watch page button
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the user 'donationLink' profile field. User::setDonationLink objects/user.php stores the value and save validates it only with filtervar..., FILTERVALIDATEURL, which accepts...
CVE-2026-89253 AVideo Stored XSS via donationLink in watch page button
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the user 'donationLink' profile field. User::setDonationLink objects/user.php stores the value and save validates it only with filtervar..., FILTERVALIDATEURL, which accepts...
CVE-2026-89253
WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) has a stored cross-site scripting (XSS) vulnerability in the user donationLink profile field. The value is validated only with filter_var(..., FILTER_VALIDATE_URL), which accepts injected payloads, and is output via strip_tags(...
EUVD-2026-76065
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the user 'donationLink' profile field. User::setDonationLink objects/user.php stores the value and save validates it only with filtervar..., FILTERVALIDATEURL, which accepts...
PT-2026-89859
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the Bookmark plugin where chapter names are not encoded before being concatenated into public watch-page HTML. A video owner can inject malicious scripts via the bookmark name...
CVE-2018-25420
AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send GET requests to watch.php with crafted SQL payloads to extract sensitive database informati...
EUVD-2018-21942
AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send GET requests to watch.php with crafted SQL payloads to extract sensitive database informati...
CVE-2018-25420
AiOPMSD Final 1.0.0 contains an SQL injection in watch.php where the id parameter can be crafted via GET requests to execute arbitrary SQL. The vulnerability allows unauthenticated attackers to extract sensitive data, including usernames, database names, and version details. Affected component is...
CVE-2018-25420 AiOPMSD Final 1.0.0 SQL Injection via watch.php
AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send GET requests to watch.php with crafted SQL payloads to extract sensitive database informati...
UBUNTU-CVE-2023-41884
ZoneMinder is a free, open source Closed-circuit television software application. In WWW/AJAX/watch.php, Line: 51 takes a few parameter in sql query without sanitizing it which makes it vulnerable to sql injection. This vulnerability is fixed in 1.36.34...
Video Sharing Website SQL注入漏洞
Video Sharing Website is a video sharing website. A SQL injection vulnerability exists in Campcodes Video Sharing Website version 1.0, which stems from a problem in the file watch.php, where manipulation of the parameter code can lead to sql injection...
