AVideo 和 YouPHPTube 跨站脚本漏洞

YouPHPTube is a PHP-based video website system. wwbn Avideo is a video platform builder written in PHP by the team at wwbn WWBN. AVideo and YouPHPTube suffer from a cross-site scripting vulnerability that could be exploited by a remote attacker to steal an administrator's session cookie or perfor...

PT-2021-16822 · Unknown · Avideo/Youphptube

Name of the Vulnerable Software and Affected Versions: AVideo/YouPHPTube versions 10.0 and prior Description: The issue allows a remote unauthenticated attacker to retrieve database information, such as application password hashes, through a SQL injection in the catName parameter. Recommendations...

PT-2021-16824 · Unknown · Avideo/Youphptube

Name of the Vulnerable Software and Affected Versions: AVideo/YouPHPTube versions 10.0 and prior Description: The issue allows a remote attacker to steal administrators' session cookies or perform actions as an administrator due to multiple reflected Cross Script Scripting vulnerabilities via the...

PT-2021-16826 · Unknown · Avideo/Youphptube

Name of the Vulnerable Software and Affected Versions: AVideo/YouPHPTube versions 10.0 and prior Description: The issue affects AVideo/YouPHPTube, allowing a remote attacker to steal administrators' session cookies or perform actions as an administrator due to multiple reflected Cross Scripting...

CVE-2021-25875: Improper Neutralization of Input During Web Page Generation

AVideo/YouPHPTube AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross Script Scripting vulnerabilities via the searchPhrase parameter which allows a remote attacker to steal administrators' session cookies or perform actions as an administrator...

AVideo 和 YouPHPTube 跨站脚本漏洞

YouPHPTube is a PHP-based video website system. wwbn Avideo is a video platform builder written in PHP by the team at WWbn WWBN. AVideo and YouPHPTube suffer from a cross-site scripting vulnerability that could be exploited by a remote attacker to steal an administrator's session cookie or perfor...

CVE-2021-25876: Improper Neutralization of Input During Web Page Generation

AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross Script Scripting vulnerabilities via the u parameter which allows a remote attacker to steal administrators' session cookies or perform actions as an administrator...

Open Redirect in wwbn/avideo

✍️ Description There is an open redirect vulnerability in the following URL: https://demo.avideo.com/signUp?redirectUri=https://google.com/ 🕵️‍♂️ Proof of Concept text Step to reproduce 1. open above URL 2. signup in the application 3. you redirect to google.com 💥 Impact That causes a redirection...

CVE-2021-21286

AVideo Platform is an open-source Audio and Video platform. It is similar to a self-hosted YouTube. In AVideo Platform before version 10.2 there is an authorization bypass vulnerability which enables an ordinary user to get admin control. This is fixed in version 10.2. All queries now remove the...

CVE-2021-21286

AVideo Platform is an open-source Audio and Video platform. It is similar to a self-hosted YouTube. In AVideo Platform before version 10.2 there is an authorization bypass vulnerability which enables an ordinary user to get admin control. This is fixed in version 10.2. All queries now remove the...

Authorization

AVideo Platform is an open-source Audio and Video platform. It is similar to a self-hosted YouTube. In AVideo Platform before version 10.2 there is an authorization bypass vulnerability which enables an ordinary user to get admin control. This is fixed in version 10.2. All queries now remove the...

CVE-2021-21286

AVideo Platform is an open-source Audio and Video platform. It is similar to a self-hosted YouTube. In AVideo Platform before version 10.2 there is an authorization bypass vulnerability which enables an ordinary user to get admin control. This is fixed in version 10.2. All queries now remove the...

CVE-2021-21286

CVE-2021-21286 affects AVideo Platform (self-hosted video platform). The vulnerability is an authorization bypass present in versions before 10.2 that could let an ordinary user gain admin control. The issue is fixed in version 10.2, with changes that remove the pass hash and the recoverPass hash...

CVE-2021-21286 Authorization Bypass in AVideo Platform

AVideo Platform is an open-source Audio and Video platform. It is similar to a self-hosted YouTube. In AVideo Platform before version 10.2 there is an authorization bypass vulnerability which enables an ordinary user to get admin control. This is fixed in version 10.2. All queries now remove the...

Wwbn Avideo Permission License and Access Control Issues Vulnerability

Wwbn Avideo is a video platform builder written in PHP by the Wwbn WWBN team. AVideo Platform suffers from a Permission Permission and Access Control Issues vulnerability that stems from an authorization bypass vulnerability that could allow a normal user to gain administrative control...

PT-2021-14389

Name of the Vulnerable Software and Affected Versions: AVideo Platform versions prior to 10.2 Description: The issue allows an ordinary user to bypass authorization and gain admin control. This is resolved by removing the pass hash and the recoverPass hash from all queries. Recommendations: For...

CVE-2021-21286: Incorrect Authorization

AVideo Platform is an open-source Audio and Video platform. It is similar to a self-hosted YouTube. In AVideo Platform before version 10.2 there is an authorization bypass vulnerability which enables an ordinary user to get admin control. This is fixed in version 10.2. All queries now remove the...

CVE-2020-23489

The import.json.php file before 8.9 for Avideo is vulnerable to a File Deletion vulnerability. This allows the deletion of configuration.php, which leads to certain privilege checks not being in place, and therefore a user can escalate privileges to admin...

CVE-2020-23490

There was a local file disclosure vulnerability in AVideo 8.9 via the proxy streaming. An unauthenticated attacker can exploit this issue to read an arbitrary file on the server. Which could leak database credentials or other sensitive information such as /etc/passwd file...

CVE-2020-23490

There was a local file disclosure vulnerability in AVideo 8.9 via the proxy streaming. An unauthenticated attacker can exploit this issue to read an arbitrary file on the server. Which could leak database credentials or other sensitive information such as /etc/passwd file...