CVE-2026-61573

AVideo is a video-sharing Platform. Prior to 8.1.0, the anonymous login interface reflects request values into HTML and JavaScript without output encoding. In view/index.php, webSiteRootURL is returned verbatim by Streamer::getStreamerURL in objects/Streamer.php and reaches navigation and form...

EUVD-2026-112511

AVideo is a video-sharing Platform. Prior to 8.1.0, the anonymous login interface reflects request values into HTML and JavaScript without output encoding. In view/index.php, webSiteRootURL is returned verbatim by Streamer::getStreamerURL in objects/Streamer.php and reaches navigation and form...

CVE-2026-61573

AVideo, a video-sharing platform, contains a reflected cross-site scripting (XSS) vulnerability in its anonymous login interface prior to version 8.1.0 . The root cause is the lack of output encoding for request values. Specifically, webSiteRootURL is returned verbatim by Streamer::getStreamerURL...

CVE-2026-61573

AVideo is a video-sharing Platform. Prior to 8.1.0, the anonymous login interface reflects request values into HTML and JavaScript without output encoding. In "view/index.php", "webSiteRootURL" is returned verbatim by "Streamer::getStreamerURL" in "objects/Streamer.php" and reaches navigation and...

CVE-2026-61573 AVideo-Encoder: reflected cross-site scripting in the login interface

AVideo is a video-sharing Platform. Prior to 8.1.0, the anonymous login interface reflects request values into HTML and JavaScript without output encoding. In view/index.php, webSiteRootURL is returned verbatim by Streamer::getStreamerURL in objects/Streamer.php and reaches navigation and form...

CVE-2026-61573: WWBN AVideo-Encoder: AVideo is a video-sharing Platform

AVideo is a video-sharing Platform. Prior to 8.1.0, the anonymous login interface reflects request values into HTML and JavaScript without output encoding. In view/index.php, webSiteRootURL is returned verbatim by Streamer::getStreamerURL in objects/Streamer.php and reaches navigation and form...

World Wide Broadcast Network AVideo-Encoder Cross-site Scripting Vulnerability

Versions prior to AVideo-Encoder 8.1.0 of the World Wide Broadcast Network contain a cross-site scripting vulnerability. This vulnerability arises because the anonymous login interface fails to properly encode request values such as webSiteRootURL, user, pass, and POST lang within view/index.php,...

PT-2026-129217

AVideo is a video-sharing Platform. Prior to 8.1.0, the anonymous login interface reflects request values into HTML and JavaScript without output encoding. In view/index.php, webSiteRootURL is returned verbatim by Streamer::getStreamerURL in objects/Streamer.php and reaches navigation and form...

CVE-2021-47749: Improper Limitation of a Pathname to a Restricted Directory

YouPHPTube = 7.8 contains a local file inclusion vulnerability that allows unauthenticated attackers to access arbitrary files by manipulating the 'lang' parameter in GET requests. Attackers can exploit the path traversal flaw in locale/function.php to include and view PHP files outside the...