PT-2021-16823 · Unknown · Avideo/Youphptube

Name of the Vulnerable Software and Affected Versions: AVideo/YouPHPTube versions 10.0 and prior Description: The issue allows a remote attacker to steal administrators' session cookies or perform actions as an administrator due to multiple reflected Cross Scripting vulnerabilities. This is...

PT-2021-16826 · Unknown · Avideo/Youphptube

Name of the Vulnerable Software and Affected Versions: AVideo/YouPHPTube versions 10.0 and prior Description: The issue affects AVideo/YouPHPTube, allowing a remote attacker to steal administrators' session cookies or perform actions as an administrator due to multiple reflected Cross Scripting...

PT-2021-16824 · Unknown · Avideo/Youphptube

Name of the Vulnerable Software and Affected Versions: AVideo/YouPHPTube versions 10.0 and prior Description: The issue allows a remote attacker to steal administrators' session cookies or perform actions as an administrator due to multiple reflected Cross Script Scripting vulnerabilities via the...

PT-2021-16822 · Unknown · Avideo/Youphptube

Name of the Vulnerable Software and Affected Versions: AVideo/YouPHPTube versions 10.0 and prior Description: The issue allows a remote unauthenticated attacker to retrieve database information, such as application password hashes, through a SQL injection in the catName parameter. Recommendations...

AVideo 和 YouPHPTube 跨站脚本漏洞

YouPHPTube is a PHP-based video website system. wwbn Avideo is a video platform builder written in PHP by the team at WWbn WWBN. AVideo and YouPHPTube suffer from a cross-site scripting vulnerability that could be exploited by a remote attacker to steal an administrator's session cookie or perfor...

PT-2021-16825 · Unknown · Avideo/Youphptube

Name of the Vulnerable Software and Affected Versions: AVideo/YouPHPTube versions 10.0 and prior Description: The issue allows an administrator-privileged user to write files on the filesystem using flag and code variables in the file save.php. This is due to insecure file write. Recommendations:...

AVideo 和 YouPHPTube 跨站脚本漏洞

YouPHPTube is a PHP-based video website system. wwbn Avideo is a video platform builder written in PHP by the team at wwbn WWBN. AVideo and YouPHPTube suffer from a cross-site scripting vulnerability that could be exploited by a remote attacker to steal an administrator's session cookie or perfor...

Open Redirect in wwbn/avideo

✍️ Description There is an open redirect vulnerability in the following URL: https://demo.avideo.com/signUp?redirectUri=https://google.com/ 🕵️‍♂️ Proof of Concept text Step to reproduce 1. open above URL 2. signup in the application 3. you redirect to google.com 💥 Impact That causes a redirection...

CVE-2021-21286

AVideo Platform is an open-source Audio and Video platform. It is similar to a self-hosted YouTube. In AVideo Platform before version 10.2 there is an authorization bypass vulnerability which enables an ordinary user to get admin control. This is fixed in version 10.2. All queries now remove the...

CVE-2021-21286

AVideo Platform is an open-source Audio and Video platform. It is similar to a self-hosted YouTube. In AVideo Platform before version 10.2 there is an authorization bypass vulnerability which enables an ordinary user to get admin control. This is fixed in version 10.2. All queries now remove the...

Authorization

AVideo Platform is an open-source Audio and Video platform. It is similar to a self-hosted YouTube. In AVideo Platform before version 10.2 there is an authorization bypass vulnerability which enables an ordinary user to get admin control. This is fixed in version 10.2. All queries now remove the...

CVE-2021-21286 Authorization Bypass in AVideo Platform

AVideo Platform is an open-source Audio and Video platform. It is similar to a self-hosted YouTube. In AVideo Platform before version 10.2 there is an authorization bypass vulnerability which enables an ordinary user to get admin control. This is fixed in version 10.2. All queries now remove the...

CVE-2021-21286

CVE-2021-21286 affects AVideo Platform (self-hosted video platform). The vulnerability is an authorization bypass present in versions before 10.2 that could let an ordinary user gain admin control. The issue is fixed in version 10.2, with changes that remove the pass hash and the recoverPass hash...

Wwbn Avideo Permission License and Access Control Issues Vulnerability

Wwbn Avideo is a video platform builder written in PHP by the Wwbn WWBN team. AVideo Platform suffers from a Permission Permission and Access Control Issues vulnerability that stems from an authorization bypass vulnerability that could allow a normal user to gain administrative control...

CVE-2020-23489

The import.json.php file before 8.9 for Avideo is vulnerable to a File Deletion vulnerability. This allows the deletion of configuration.php, which leads to certain privilege checks not being in place, and therefore a user can escalate privileges to admin...

CVE-2020-23490

There was a local file disclosure vulnerability in AVideo 8.9 via the proxy streaming. An unauthenticated attacker can exploit this issue to read an arbitrary file on the server. Which could leak database credentials or other sensitive information such as /etc/passwd file...

CVE-2020-23490

There was a local file disclosure vulnerability in AVideo 8.9 via the proxy streaming. An unauthenticated attacker can exploit this issue to read an arbitrary file on the server. Which could leak database credentials or other sensitive information such as /etc/passwd file...

CVE-2020-23489

The import.json.php file before 8.9 for Avideo is vulnerable to a File Deletion vulnerability. This allows the deletion of configuration.php, which leads to certain privilege checks not being in place, and therefore a user can escalate privileges to admin...

Arbitrary file deletion

The import.json.php file before 8.9 for Avideo is vulnerable to a File Deletion vulnerability. This allows the deletion of configuration.php, which leads to certain privilege checks not being in place, and therefore a user can escalate privileges to admin...

CVE-2020-23489

The CVE-2020-23489 issue affects Avideo prior to version 8.9. The import.json.php file allows a File Deletion vulnerability (deleting configuration.php) which disables certain privilege checks and enables privilege escalation to admin. Documents from multiple sources (including Red Hat and GitHub...