74 matches found
PT-2026-69381
Name of the Vulnerable Software and Affected Versions All-in-One Video Gallery versions prior to 4.9.2 Description The software implements a public, unauthenticated file-download handler that allows Server-Side Request Forgery SSRF. This occurs when the AIOVG Public Video::download video function...
CVE-2026-19075: Server-Side Request Forgery (SSRF)
All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by ?vdl= on any aiovgvideos post public/video.php, AIOVGPublicVideo::downloadvideo, which reads the post's mp4 meta value and streams that URL's response back to the requester...
CVE-2026-50745
CVE-2026-50745 concerns Revive Adserver’s stats-video.php where user input is reflected due to missing sanitisation and unencoded URL parameters, arising from improper handling of the Smarty url helper. The HackerOne report confirms a reflected XSS vector in this script. No exploitation status or...
CVE-2026-50745
A missing sanitisation vulnerability exists with user input in the stats-video.php script. The way URLs to this script were constructed did not follow best practices, and the output of the Smarty custom helper function url was neither properly encoded nor sanitised, allowing user‑supplied input t...
EUVD-2026-39605
A missing sanitisation vulnerability exists with user input in the stats-video.php script. The way URLs to this script were constructed did not follow best practices, and the output of the Smarty custom helper function url was neither properly encoded nor sanitised, allowing user‑supplied input t...
CVE-2026-50745: Improper Neutralization of Input During Web Page Generation
A missing sanitisation vulnerability exists with user input in the stats-video.php script. The way URLs to this script were constructed did not follow best practices, and the output of the Smarty custom helper function url was neither properly encoded nor sanitised, allowing user‑supplied input t...
CVE-2026-41061: Improper Neutralization of Input During Web Page Generation
WWBN AVideo is an open source video platform. In versions 29.0 and below, the isValidDuration regex at objects/video.php:918 uses /^0-91,2:0-91,2:0-91,2/ without a $ end anchor, allowing arbitrary HTML/JavaScript to be appended after a valid duration prefix. The crafted duration is stored in the...
PT-2026-35103
Summary The isValidDuration regex at objects/video.php:918 uses /^0-91,2:0-91,2:0-91,2/ without a $ end anchor, allowing arbitrary HTML/JavaScript to be appended after a valid duration prefix. The crafted duration is stored in the database and rendered without HTML escaping via echo...
CVE-2026-28501: Improper Neutralization of Special Elements used in an SQL Command
WWBN AVideo is an open source video platform. Prior to version 24.0, an unauthenticated SQL Injection vulnerability exists in AVideo within the objects/videos.json.php and objects/video.php components. The application fails to properly sanitize the catName parameter when it is supplied via a...
CVE-2021-47914: Improper Neutralization of Input During Web Page Generation
PHP Melody version 3.0 contains a persistent cross-site scripting vulnerability in the edit-video.php submitted parameter that allows remote attackers to inject malicious script code. Attackers can exploit this vulnerability to execute arbitrary JavaScript, potentially leading to session hijackin...
PT-2025-52614
Name of the Vulnerable Software and Affected Versions SeaCMS versions up to 13.3 Description A SQL injection issue exists in SeaCMS. The issue is located in the admin video.php file, specifically through manipulation of the e id argument within an unknown function. This allows for remote...
EUVD-2010-2467
Malware in sbrugna...
EUVD-2024-41071
Malicious code in bioql PyPI...
FoxCMS 注入漏洞
FoxCMS is a free commercial open source content management system from China Qianxu FoxCMS. FoxCMS 1.2.5 and previous versions exist injection vulnerability, the vulnerability stems from the file app/admin/controller/Video.php in the parameter ids of the wrong operation leads to SQL injection...
CVE-2025-7568: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in qianfox FoxCMS up to 1.2.5. It has been classified as critical. Affected is the function batchCope of the file app/admin/controller/Video.php. The manipulation of the argument ids leads to sql injection. It is possible to launch the attack remotely. The exploit has be...
CVE-2024-44683
Seacms v13 is vulnerable to Cross Site Scripting XSS via admin-video.php...
CVE-2023-50470
A cross-site scripting XSS vulnerability in the component admin Video.php of SeaCMS v12.8 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...
SeaCMS cross-site scripting vulnerability (CNVD-2024-39583)
SeaCMS is a free, open source web content management system written in PHP by SeaCMS. The system has been designed primarily to manage video-on-demand resources. A cross-site scripting vulnerability exists in SeaCMS version v13, which originates from a cross-site scripting vulnerability contained...
