EUVD-2026-81286

AVideo through 29.0 commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify video access permissions in the setapicomment function, allowing authenticated users to post comments on password-protected and group-restricted videos. Attackers can submit POST requests to the comment API endpoi...

EUVD-2026-81277

In AVideo through 29.0, the API getapivideo endpoint contains a broken access control vulnerability in the cleantitle branch that returns user-group-restricted videos with owner PII to anonymous callers. Attackers can query videos by their public slug to bypass group restrictions and retrieve...

EUVD-2026-81278

WWBN AVideo through 29.0 contains an authentication bypass vulnerability where the stored password hash is accepted as a valid login credential through two independent code paths in loginFromRequest and encryptPasswordVerify. Attackers who obtain the stored users.password hash value can...

EUVD-2026-81282

AVideo WWBN/AVideo through 29.0 commit e01e41ecc is vulnerable to cross-site request forgery. objects/videoAddNew.json.php disables AVideo's automatic CSRF guard $global'skipAutoCSRFCheck' and the untrusted-request check $global'bypassSameDomainCheck' merely because 'user' and 'pass' parameters a...

EUVD-2026-81279

In AVideo through 29.0, the autoCSRFGuard function maintains a hardcoded allowlist of exempt basenames tested without directory context, allowing plugin files matching core filenames to inherit CSRF exemptions. The LoginWordPress plugin file login.json.php inherits an exemption and unconditionall...

EUVD-2026-81284

AVideo through 29.0 current revision e01e41ecc contains a stored cross-site scripting vulnerability. The unauthenticated view-counter endpoint objects/videoAddViewCount.json.php reaches VideoStatistic::save, which writes the caller's User-Agent via getUserAgentInfo, which returns unrecognized age...

EUVD-2026-81281

In AVideo through 29.0, Like::construct performs counter arithmetic on raw request values before validation, allowing array-typed parameters to desynchronize stored votes from counters. Authenticated attackers can send array-typed like parameters followed by ordinary requests to drive video like...

EUVD-2026-81283

AVideo through 29.0 contains a race condition in the enforceRateLimit function that fails to atomically increment rate limit counters, allowing attackers to bypass all rate limits including login brute-force protection by issuing concurrent requests. Attackers can submit parallel credential...

CVE-2026-92585

AVideo through 29.0 commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the API like endpoint, allowing logged-in users to vote on password-protected and group-restricted videos. Attackers can submit like and dislike requests to increment vote counters on...

CVE-2026-92586

AVideo through 29.0 commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify video access permissions in the setapicomment function, allowing authenticated users to post comments on password-protected and group-restricted videos. Attackers can submit POST requests to the comment API endpoi...

CVE-2026-92580

In AVideo through 29.0, the CloneSite plugin is vulnerable to stored OS command injection. In plugin/CloneSite/cloneClient.json.php line 270 the stored SSH password is substituted into the command string sshpass -p 'password' rsync ... with a plain strreplace and no escaping, so a single quote in...

CVE-2026-92581

In AVideo through 29.0, Like::construct performs counter arithmetic on raw request values before validation, allowing array-typed parameters to desynchronize stored votes from counters. Authenticated attackers can send array-typed like parameters followed by ordinary requests to drive video like...

CVE-2026-92584

AVideo through 29.0 current revision e01e41ecc contains a stored cross-site scripting vulnerability. The unauthenticated view-counter endpoint objects/videoAddViewCount.json.php reaches VideoStatistic::save, which writes the caller's User-Agent via getUserAgentInfo, which returns unrecognized age...

CVE-2026-92582

AVideo WWBN/AVideo through 29.0 commit e01e41ecc is vulnerable to cross-site request forgery. objects/videoAddNew.json.php disables AVideo's automatic CSRF guard $global'skipAutoCSRFCheck' and the untrusted-request check $global'bypassSameDomainCheck' merely because 'user' and 'pass' parameters a...

CVE-2026-92579

In AVideo through 29.0, the autoCSRFGuard function maintains a hardcoded allowlist of exempt basenames tested without directory context, allowing plugin files matching core filenames to inherit CSRF exemptions. The LoginWordPress plugin file login.json.php inherits an exemption and unconditionall...

CVE-2026-92578

WWBN AVideo through 29.0 contains an authentication bypass vulnerability where the stored password hash is accepted as a valid login credential through two independent code paths in loginFromRequest and encryptPasswordVerify. Attackers who obtain the stored users.password hash value can...

CVE-2026-92583

AVideo through 29.0 contains a race condition in the enforceRateLimit function that fails to atomically increment rate limit counters, allowing attackers to bypass all rate limits including login brute-force protection by issuing concurrent requests. Attackers can submit parallel credential...

CVE-2026-92577

In AVideo through 29.0, the API getapivideo endpoint contains a broken access control vulnerability in the cleantitle branch that returns user-group-restricted videos with owner PII to anonymous callers. Attackers can query videos by their public slug to bypass group restrictions and retrieve...

CVE-2026-92586

AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) contains an authorization bypass in the set_api_comment function. The function fails to verify video access permissions, allowing authenticated users to post comments on password-protected and group-restricted videos by submitt...

CVE-2026-92585

AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to validate video access permissions in its API like endpoint. The root cause is a missing authorization check in the set.json.php endpoint when called with APIName parameters, allowing any logged-in user to submit like o...