CVE-2026-61572

AVideo is a video-sharing Platform. Before the initial remediation attempt in 8.1.0, urlgetcontents in objects/functions.php accepts caller-controlled destinations after only FILTERVALIDATEURL syntax validation, without rejecting private, loopback, or link-local addresses, and disables TLS peer...

EUVD-2026-112512

AVideo is a video-sharing Platform. Before the initial remediation attempt in 8.1.0, urlgetcontents in objects/functions.php accepts caller-controlled destinations after only FILTERVALIDATEURL syntax validation, without rejecting private, loopback, or link-local addresses, and disables TLS peer...

CVE-2026-61572 AVideo-Encoder: unauthenticated full-response server-side request forgery

AVideo is a video-sharing Platform. Before the initial remediation attempt in 8.1.0, urlgetcontents in objects/functions.php accepts caller-controlled destinations after only FILTERVALIDATEURL syntax validation, without rejecting private, loopback, or link-local addresses, and disables TLS peer...

CVE-2026-61572

AVideo, a video-sharing platform, is vulnerable to unauthenticated full-response Server-Side Request Forgery (SSRF) . The root cause lies in objects/functions.php, where url_get_contents accepts caller-controlled destinations following only basic syntax validation, failing to block private, loopb...

CVE-2026-61572 AVideo-Encoder: unauthenticated full-response server-side request forgery

AVideo is a video-sharing Platform. Before the initial remediation attempt in 8.1.0, urlgetcontents in objects/functions.php accepts caller-controlled destinations after only FILTERVALIDATEURL syntax validation, without rejecting private, loopback, or link-local addresses, and disables TLS peer...

CVE-2026-61572 AVideo-Encoder: unauthenticated full-response server-side request forgery

AVideo is a video-sharing Platform. Before the initial remediation attempt in 8.1.0, urlgetcontents in objects/functions.php accepts caller-controlled destinations after only FILTERVALIDATEURL syntax validation, without rejecting private, loopback, or link-local addresses, and disables TLS peer...

CVE-2026-61572: WWBN AVideo-Encoder: AVideo is a video-sharing Platform

AVideo is a video-sharing Platform. Before the initial remediation attempt in 8.1.0, urlgetcontents in objects/functions.php accepts caller-controlled destinations after only FILTERVALIDATEURL syntax validation, without rejecting private, loopback, or link-local addresses, and disables TLS peer...

PT-2026-129216

AVideo is a video-sharing Platform. Before the initial remediation attempt in 8.1.0, url get contents in objects/functions.php accepts caller-controlled destinations after only FILTER VALIDATE URL syntax validation, without rejecting private, loopback, or link-local addresses, and disables TLS pe...

World Wide Broadcast Network AVideo-Encoder server request forgery vulnerability

Versions prior to AVideo-Encoder 8.1.0 of the World Wide Broadcast Network contain a server-side request forgery vulnerability. This vulnerability arises because urlgetcontents in objects/functions.php performs only syntactic validation on URLs controlled by callers; it fails to reject private,...

CVE-2026-92913

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 uses a cryptographically weak pseudo-random number generator when creating account activation / login pairing codes. getRandomCode in objects/functions.php derives the code entirely from uniqid sprintf'%08x%05x', seconds, microseconds...

CVE-2026-92913 AVideo Weak PRNG Activation Code Authentication Bypass

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 uses a cryptographically weak pseudo-random number generator when creating account activation / login pairing codes. getRandomCode in objects/functions.php derives the code entirely from uniqid sprintf'%08x%05x', seconds, microseconds...

CVE-2026-92913: Use of Insufficiently Random Values

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 uses a cryptographically weak pseudo-random number generator when creating account activation / login pairing codes. getRandomCode in objects/functions.php derives the code entirely from uniqid sprintf'%08x%05x', seconds, microseconds...

PT-2026-94236

Name of the Vulnerable Software and Affected Versions AVideo versions prior to commit c3edcc274c389816d434acadac07ee78eaf330c1 Description The software uses a cryptographically weak pseudo-random number generator to create account activation and login pairing codes. The getRandomCode function in...

CVE-2026-41060

WWBN AVideo is an open source video platform. In versions 29.0 and below, the "isSSRFSafeURL" function in "objects/functions.php" contains a same-domain shortcircuit lines 4290-4296 that allows any URL whose hostname matches "webSiteRootURL" to bypass all SSRF protections. Because the check...

CVE-2026-41056

WWBN AVideo is an open source video platform. In versions 29.0 and below, the "allowOrigin$allowAll=true" function in "objects/functions.php" reflects any arbitrary "Origin" header back in "Access-Control-Allow-Origin" along with "Access-Control-Allow-Credentials: true". This function is called b...

CVE-2026-41056: Permissive Cross-domain Policy with Untrusted Domains

WWBN AVideo is an open source video platform. In versions 29.0 and below, the allowOrigin$allowAll=true function in objects/functions.php reflects any arbitrary Origin header back in Access-Control-Allow-Origin along with Access-Control-Allow-Credentials: true. This function is called by both...

CVE-2026-41060: Server-Side Request Forgery (SSRF)

WWBN AVideo is an open source video platform. In versions 29.0 and below, the isSSRFSafeURL function in objects/functions.php contains a same-domain shortcircuit lines 4290-4296 that allows any URL whose hostname matches webSiteRootURL to bypass all SSRF protections. Because the check compares on...

PT-2026-35118

Summary The isSSRFSafeURL function in objects/functions.php contains a same-domain shortcircuit lines 4290-4296 that allows any URL whose hostname matches webSiteRootURL to bypass all SSRF protections. Because the check compares only the hostname and ignores the port, an attacker can reach...

PT-2026-35108

Summary The allowOrigin$allowAll=true function in objects/functions.php reflects any arbitrary Origin header back in Access-Control-Allow-Origin along with Access-Control-Allow-Credentials: true. This function is called by both plugin/API/get.json.php and plugin/API/set.json.php — the primary API...

CVE-2026-33690

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the "getRealIpAddr" function in "objects/functions.php" trusts user-controlled HTTP headers to determine the client's IP address. An attacker can spoof their IP address by sending forged headers, bypassing any...