CVE-2020-37173

CVE-2020-37173 affects AVideo Platform 8.1 . The vulnerability is an information-disclosure flaw in the "playlistsFromUser.json.php" endpoint, where manipulating the users_id parameter can enumerate user details. Reported exposed data includes email, password hash, and administrative status, indi...

CVE-2020-37172

CVE-2020-37172 affects AVideo Platform 8.1. The issue is a cross-site request forgery that lets an unauthenticated attacker use a user’s recovery token via the recoverPass endpoint to change credentials, including password reset. The vulnerability is evaluated with a CVSS v3.1 base score of 9.8 (...

CVE-2020-37172 AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)

AVideo Platform 8.1 contains a cross-site request forgery vulnerability that allows attackers to reset user passwords by exploiting the password recovery mechanism. Attackers can craft malicious requests to the recoverPass endpoint using the user's recovery token to change account credentials...

CVE-2020-37172

AVideo Platform 8.1 contains a cross-site request forgery vulnerability that allows attackers to reset user passwords by exploiting the password recovery mechanism. Attackers can craft malicious requests to the recoverPass endpoint using the user's recovery token to change account credentials...

PT-2026-7672

Name of the Vulnerable Software and Affected Versions AVideo Platform version 8.1 Description An information disclosure issue exists in AVideo Platform version 8.1. This allows attackers to enumerate user details. The issue is present in the playlistsFromUser.json.php API endpoint. By manipulatin...

CVE-2020-37158: Weak Password Recovery Mechanism for Forgotten Password

AVideo Platform 8.1 contains a cross-site request forgery vulnerability that allows attackers to reset user passwords by exploiting the password recovery mechanism. Attackers can craft malicious requests to the recoverPass endpoint using the user's recovery token to change account credentials...

CVE-2020-37173: Exposure of Private Personal Information to an Unauthorized Actor

AVideo Platform 8.1 contains an information disclosure vulnerability that allows attackers to enumerate user details through the playlistsFromUser.json.php endpoint. Attackers can retrieve sensitive user information including email, password hash, and administrative status by manipulating the...

CVE-2020-37172: Weak Password Recovery Mechanism for Forgotten Password

AVideo Platform 8.1 contains a cross-site request forgery vulnerability that allows attackers to reset user passwords by exploiting the password recovery mechanism. Attackers can craft malicious requests to the recoverPass endpoint using the user's recovery token to change account credentials...

📄 AVideo 14.3.1 notify.ffmpeg.json.php Remote Code Execution

AVideo version 14.3.1 unauthenticated remote code execution exploit that leverages notify.ffmpeg.json.php. ============================================================================================================================================= | Title : AVideo 14.3.1 via notify.ffmpeg.json.p...

CVE-2025-34438

AVideo versions prior to 20.1 contain an insecure direct object reference vulnerability allowing users with upload permissions to modify the rotation metadata of any video. The endpoint verifies upload capability but fails to enforce ownership or management rights for the targeted video...

CVE-2025-34437

AVideo versions prior to 20.1 permit any authenticated user to upload comment images to videos owned by other users. The endpoint validates authentication but omits ownership checks, allowing attackers to perform unauthorized uploads to arbitrary video objects...

CVE-2025-34436 AVideo < 20.1 IDOR Arbitrary File Upload

AVideo versions prior to 20.1 allow any authenticated user to upload files into directories belonging to other users due to an insecure direct object reference. The upload functionality verifies authentication but does not enforce ownership checks...

AVideo 访问控制错误漏洞

AVideo is an open source broadcast network creation tool from World Wide Broadcast Network. An access control error vulnerability exists in AVideo versions prior to 20.0 that stems from a lack of authentication and ownership verification in the ImageGallery plugin endpoint, which could lead to...

EUVD-2021-8654

Malicious code in bioql PyPI...

EUVD-2023-1654

Malicious code in bioql PyPI...

CVE-2021-21286

AVideo Platform is an open-source Audio and Video platform. It is similar to a self-hosted YouTube. In AVideo Platform before version 10.2 there is an authorization bypass vulnerability which enables an ordinary user to get admin control. This is fixed in version 10.2. All queries now remove the...

The vulnerability of the submitIndex.php file of the WWBNIndex plugin for the AVideo audio and video file exchange platform allows a hacker to execute arbitrary code.

The vulnerability of the submitIndex.php file of the WWBNIndex plugin for the AVideo audio and video file exchange platform is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially crafted POST request...

WWBN AVideo Code Issue Vulnerability

WWBN AVideo is a video platform builder written in PHP by the WWBN team. WWBN AVideo suffers from a code issue that stems from an unrestricted php file upload vulnerability in the temporary copy method of the import.json.php page...

CVE-2023-30860

WWBN AVideo is an open source video platform. In AVideo prior to version 12.4, a normal user can make a Meeting Schedule where the user can invite another user in that Meeting, but it does not properly sanitize the malicious characters when creating a Meeting Room. This allows attacker to insert...

WWBN AVideo SQL注入漏洞

WWBN AVideo is a video platform builder written in PHP by the WWBN team. WWBN AVideo version 11.6 suffers from a SQL injection vulnerability that stems from a sql injection vulnerability in the ObjectYPT function. An attacker can use this vulnerability to cause an sql injection via a specially...