CVE-2026-34613: Cross-Site Request Forgery (CSRF)

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo endpoint objects/pluginSwitch.json.php allows administrators to enable or disable any installed plugin. The endpoint checks for an active admin session but does not validate a CSRF token. Additionally, the plugin...

PT-2019-17492

Name of the Vulnerable Software and Affected Versions YouPHPTube version 7.6 Description The issue allows specially crafted web requests to cause SQL injections. An attacker can exploit this by sending a web request with the dir parameter in the "/objects/pluginSwitch.json.php" endpoint...

PT-2019-17490

Name of the Vulnerable Software and Affected Versions YouPHPTube version 7.6 Description The issue allows for SQL injection attacks in the authenticated section of the software. An attacker can craft special web requests to inject SQL code, potentially exploiting the uuid parameter in the...

PT-2019-17491

Name of the Vulnerable Software and Affected Versions YouPHPTube version 7.6 Description The issue allows for SQL injection attacks in the authenticated section. An attacker can craft special web requests to inject SQL code, potentially exploiting the Parameter name in the...

CVE-2019-5123: Improper Neutralization of Special Elements used in an SQL Command

Specially crafted web requests can cause SQL injections in YouPHPTube 7.6. An attacker can send a web request with Parameter dir in /objects/pluginSwitch.json.php...

CVE-2019-5121: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerabilities exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with Parameter uuid in /objects/pluginSwitch.json.php...

CVE-2019-5122: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerabilities exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with Parameter name in /objects/pluginSwitch.json.php...

YouPHPTube pluginSwitch.json.php file SQL injection vulnerability

YouPHPTube is a PHP-based video website system. A SQL injection vulnerability exists in the pluginSwitch.json.php file in YouPHPTube version 7.6. The vulnerability stems from a lack of validation of externally entered SQL statements in database-based applications. An attacker can exploit the...