CVE-2026-19075: Server-Side Request Forgery (SSRF)

All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by ?vdl= on any aiovgvideos post public/video.php, AIOVGPublicVideo::downloadvideo, which reads the post's mp4 meta value and streams that URL's response back to the requester...

PT-2026-69381

Name of the Vulnerable Software and Affected Versions All-in-One Video Gallery versions prior to 4.9.2 Description The software implements a public, unauthenticated file-download handler that allows Server-Side Request Forgery SSRF. This occurs when the AIOVG Public Video::download video function...