CVE-2026-61573

AVideo is a video-sharing Platform. Prior to 8.1.0, the anonymous login interface reflects request values into HTML and JavaScript without output encoding. In view/index.php, webSiteRootURL is returned verbatim by Streamer::getStreamerURL in objects/Streamer.php and reaches navigation and form...

CVE-2026-61575

AVideo is a video-sharing Platform. Prior to 8.1.0, view/queue.php uses pathinfo on the caller-controlled fileURI and stores its filename through setTitle in encoderqueue.title without neutralization. fileURI is not in the objects/security.php filter lists, and the Login::canUpload capability...

CVE-2026-61575

AVideo is a video-sharing Platform. Prior to 8.1.0, "view/queue.php" uses "pathinfo" on the caller-controlled "fileURI" and stores its filename through "setTitle" in "encoderqueue.title" without neutralization. "fileURI" is not in the "objects/security.php" filter lists, and the "Login::canUpload...

CVE-2026-61575

The AVideo video-sharing platform is vulnerable to stored DOM cross-site scripting (XSS) in versions prior to 8.1.0 . The root cause lies in view/queue.php, where the pathinfo function processes a caller-controlled fileURI and stores the resulting filename in encoder_queue.title without neutraliz...

CVE-2026-61573

AVideo, a video-sharing platform, contains a reflected cross-site scripting (XSS) vulnerability in its anonymous login interface prior to version 8.1.0 . The root cause is the lack of output encoding for request values. Specifically, webSiteRootURL is returned verbatim by Streamer::getStreamerURL...

CVE-2026-61573 AVideo-Encoder: reflected cross-site scripting in the login interface

AVideo is a video-sharing Platform. Prior to 8.1.0, the anonymous login interface reflects request values into HTML and JavaScript without output encoding. In view/index.php, webSiteRootURL is returned verbatim by Streamer::getStreamerURL in objects/Streamer.php and reaches navigation and form...

EUVD-2026-112511

AVideo is a video-sharing Platform. Prior to 8.1.0, the anonymous login interface reflects request values into HTML and JavaScript without output encoding. In view/index.php, webSiteRootURL is returned verbatim by Streamer::getStreamerURL in objects/Streamer.php and reaches navigation and form...

CVE-2026-61573 AVideo-Encoder: reflected cross-site scripting in the login interface

AVideo is a video-sharing Platform. Prior to 8.1.0, the anonymous login interface reflects request values into HTML and JavaScript without output encoding. In view/index.php, webSiteRootURL is returned verbatim by Streamer::getStreamerURL in objects/Streamer.php and reaches navigation and form...

CVE-2026-61573

AVideo is a video-sharing Platform. Prior to 8.1.0, the anonymous login interface reflects request values into HTML and JavaScript without output encoding. In "view/index.php", "webSiteRootURL" is returned verbatim by "Streamer::getStreamerURL" in "objects/Streamer.php" and reaches navigation and...

CVE-2026-61573 AVideo-Encoder: reflected cross-site scripting in the login interface

AVideo is a video-sharing Platform. Prior to 8.1.0, the anonymous login interface reflects request values into HTML and JavaScript without output encoding. In view/index.php, webSiteRootURL is returned verbatim by Streamer::getStreamerURL in objects/Streamer.php and reaches navigation and form...

CVE-2026-61573: WWBN AVideo-Encoder: AVideo is a video-sharing Platform

AVideo is a video-sharing Platform. Prior to 8.1.0, the anonymous login interface reflects request values into HTML and JavaScript without output encoding. In view/index.php, webSiteRootURL is returned verbatim by Streamer::getStreamerURL in objects/Streamer.php and reaches navigation and form...

CVE-2026-61575: WWBN AVideo-Encoder: AVideo is a video-sharing Platform

AVideo is a video-sharing Platform. Prior to 8.1.0, view/queue.php uses pathinfo on the caller-controlled fileURI and stores its filename through setTitle in encoderqueue.title without neutralization. fileURI is not in the objects/security.php filter lists, and the Login::canUpload capability...

PT-2026-129218

AVideo is a video-sharing Platform. Prior to 8.1.0, view/queue.php uses pathinfo on the caller-controlled fileURI and stores its filename through setTitle in encoder queue.title without neutralization. fileURI is not in the objects/security.php filter lists, and the Login::canUpload capability...

World Wide Broadcast Network AVideo-Encoder Cross-site Scripting Vulnerability

Versions prior to AVideo-Encoder 8.1.0 of the World Wide Broadcast Network contain a cross-site scripting vulnerability. This vulnerability arises because the anonymous login interface fails to properly encode request values such as webSiteRootURL, user, pass, and POST lang within view/index.php,...

World Wide Broadcast Network AVideo-Encoder Cross-site Scripting Vulnerability

Versions prior to AVideo-Encoder 8.1.0 of the World Wide Broadcast Network contain a cross-site scripting vulnerability. This vulnerability arises because view/queue.php utilizes pathinfo when handling fileURI values controlled by callers. Additionally, setTitle is used to store filenames without...

PT-2026-129217

AVideo is a video-sharing Platform. Prior to 8.1.0, the anonymous login interface reflects request values into HTML and JavaScript without output encoding. In view/index.php, webSiteRootURL is returned verbatim by Streamer::getStreamerURL in objects/Streamer.php and reaches navigation and form...

CVE-2008-2961: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in view/index.php in CMS Mini 0.2.2 allow remote attackers to read arbitrary local files via a .. dot dot in the 1 path and 2 p parameter...

cmsmini-lfi.txt

===================================================== CMS Mini 0.2.2 Local File Inclusion Vulnerability ===================================================== ,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CWH Underground Hacking Team...