CVE-2026-88867

WWBN AVideo, in versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1, contains a stored cross-site scripting vulnerability. objects/categoryAddNew.json.php passes the POST parameters name and iconClass to Category::setName and Category::setIconClass, which store the values...

CVE-2026-88866

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to encode the User-Agent header before storing it in login history. Attackers with any valid login account can inject malicious scripts in...

CVE-2026-88875 AVideo Incomplete API Sanitization Information Disclosure

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 master, 2026-08-23 incompletely sanitizes sensitive user fields in the APIName=video response. Video rows include columns joined from the video owner's user record, and API::getapivideo calls removeSensitiveUserFields only when the...

EUVD-2026-75426

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/PlayerSkins/seo.php that allows unauthenticated attackers to access password-protected video sources by calling getSources without password validation. Attackers can request t...

CVE-2026-88876

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization flaw in plugin/PlayerSkins/seo.php. The getSources() function is invoked without validating the configured password, allowing an unauthenticated attacker to request the seo.php endpoint with a video ...

EUVD-2026-75425

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 master, 2026-08-23 incompletely sanitizes sensitive user fields in the APIName=video response. Video rows include columns joined from the video owner's user record, and API::getapivideo calls removeSensitiveUserFields only when the...

CVE-2026-88876 AVideo PlayerSkins seo.php Missing Authorization Password-Protected VOD

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/PlayerSkins/seo.php that allows unauthenticated attackers to access password-protected video sources by calling getSources without password validation. Attackers can request t...

CVE-2026-88876 AVideo PlayerSkins seo.php Missing Authorization Password-Protected VOD

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/PlayerSkins/seo.php that allows unauthenticated attackers to access password-protected video sources by calling getSources without password validation. Attackers can request t...

CVE-2026-88875

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) incompletely sanitizes sensitive user fields in the APIName=video response. The function API::get_api_video() calls removeSensitiveUserFields() only when the caller is neither authenticated nor using a valid API...

CVE-2026-88875 AVideo Incomplete API Sanitization Information Disclosure

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 master, 2026-08-23 incompletely sanitizes sensitive user fields in the APIName=video response. Video rows include columns joined from the video owner's user record, and API::getapivideo calls removeSensitiveUserFields only when the...

CVE-2026-88874

AVideo (through revision c3edcc274c389816d434acadac07ee78eaf330c1, 2026-08-23) suffers from an authentication bypass in its live streaming feature. The Live::_getStats() method (plugin/Live/Live.php) exposes the RTMP stream key, isPasswordProtected flag, and HLS (m3u8) URL to unauthenticated call...

CVE-2026-88874 AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 Authentication Bypass

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 master, 2026-08-23 does not enforce the Live stream password check on the stats endpoint or on the HLS origin. Live::getStats plugin/Live/Live.php returns a password-protected transmission's RTMP stream key, its isPasswordProtected...

EUVD-2026-75424

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 master, 2026-08-23 does not enforce the Live stream password check on the stats endpoint or on the HLS origin. Live::getStats plugin/Live/Live.php returns a password-protected transmission's RTMP stream key, its isPasswordProtected...

CVE-2026-88874 AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 Authentication Bypass

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 master, 2026-08-23 does not enforce the Live stream password check on the stats endpoint or on the HLS origin. Live::getStats plugin/Live/Live.php returns a password-protected transmission's RTMP stream key, its isPasswordProtected...

CVE-2026-88873 WWBN AVideo Cross-Site Request Forgery via logArchive.json.php

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in view/logArchive.json.php that allows unauthenticated attackers to archive application logs by making GET requests without CSRF token validation. Attackers can craft malicious...

CVE-2026-88873

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a Cross-Site Request Forgery vulnerability in view/logArchive.json.php. The endpoint accepts GET requests without CSRF token validation , allowing unauthenticated attackers to craft malicious pages that trigger an admini...

CVE-2026-88873 WWBN AVideo Cross-Site Request Forgery via logArchive.json.php

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in view/logArchive.json.php that allows unauthenticated attackers to archive application logs by making GET requests without CSRF token validation. Attackers can craft malicious...

EUVD-2026-75423

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in view/logArchive.json.php that allows unauthenticated attackers to archive application logs by making GET requests without CSRF token validation. Attackers can craft malicious...

CVE-2026-88871

WWBN AVideo 's CustomizeUser plugin (enabled by default) contains a CSRF vulnerability in the setSubscribers.json.php endpoint, affected through commit c3edcc274c (master, 2026-08-23). The endpoint reads users_id and ExtraSubscribers from $_REQUEST and calls User::setExtraSubscribers() without re...

CVE-2026-88871 WWBN AVideo CustomizeUser setSubscribers CSRF via GET

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 master, 2026-08-23 contains a cross-site request forgery vulnerability in the CustomizeUser plugin's plugin/CustomizeUser/setSubscribers.json.php endpoint. The script reads usersid and ExtraSubscribers from $REQUEST and calls...