CVE-2026-34613: Cross-Site Request Forgery (CSRF)

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo endpoint objects/pluginSwitch.json.php allows administrators to enable or disable any installed plugin. The endpoint checks for an active admin session but does not validate a CSRF token. Additionally, the plugin...

PT-2019-17491

Name of the Vulnerable Software and Affected Versions YouPHPTube version 7.6 Description The issue allows for SQL injection attacks in the authenticated section. An attacker can craft special web requests to inject SQL code, potentially exploiting the Parameter name in the...

PT-2019-17492

Name of the Vulnerable Software and Affected Versions YouPHPTube version 7.6 Description The issue allows specially crafted web requests to cause SQL injections. An attacker can exploit this by sending a web request with the dir parameter in the "/objects/pluginSwitch.json.php" endpoint...

PT-2019-17490

Name of the Vulnerable Software and Affected Versions YouPHPTube version 7.6 Description The issue allows for SQL injection attacks in the authenticated section of the software. An attacker can craft special web requests to inject SQL code, potentially exploiting the uuid parameter in the...

CVE-2019-5122: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerabilities exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with Parameter name in /objects/pluginSwitch.json.php...

CVE-2019-5121: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerabilities exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with Parameter uuid in /objects/pluginSwitch.json.php...

CVE-2019-5123: Improper Neutralization of Special Elements used in an SQL Command

Specially crafted web requests can cause SQL injections in YouPHPTube 7.6. An attacker can send a web request with Parameter dir in /objects/pluginSwitch.json.php...