These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-22T13:16:38.403Z and has not been modified since then. CVE-2026-58001 is a medium-severity cross-site request forgery vulnerability in WWBN AVideo's videoEditLight.php. The vulnerability allows attackers to store an img tag in a video description that can transfer video ownership to an attacker-cont [truncated]
AVideo versions from commit 0dbadbca through latest master contain a server-side request forgery vulnerability in the encoder download-by-URL flow due to an unpinned retry fallback that bypasses DNS pinning validation. An authenticated attacker can supply a downloadURL that redirects to an internal address, causing the unpinned retry to follow the redirect and reach internal targets for blind SSRF attacks [truncated]
AVideo, an open-source video platform, is vulnerable to OS command injection in versions 29.0 and below. The issue arises from an incomplete fix for CVE-2026-33482, which failed to neutralize the shell background operator (&). This allows attackers to execute arbitrary OS commands on the standalone encoder server by crafting a valid encrypted payload. The vulnerability has a CVSS score of 8.1 and is consi [truncated]
The CVE-2026-33731 vulnerability affects AVideo versions prior to 29.0, specifically the Authorize.Net webhook handler. This vulnerability is classified as a signature verification bypass, allowing attackers to forge webhook requests with arbitrary payment amounts and target user IDs. By exploiting this issue, attackers can credit arbitrary wallet balances to any user account and activate premium subscrip [truncated]
AVideo versions prior to 29.0 expose .env files to unauthenticated users through the official Docker compose configuration. The official docker-compose.yml mounts the entire project root directory as the Apache document root, causing the .env file — which contains database credentials, admin passwords, and infrastructure configuration — to be served as a static file at /.env. This vulnerability allows for [truncated]
A critical vulnerability was discovered in AVideo, a video platform, through version 29.0. The vulnerability exists in the ffmpeg.json.php endpoint, where the notifyCode and callback parameters are concatenated into a shell command without proper escaping. This allows attackers who can craft a valid encrypted payload to inject arbitrary shell metacharacters into these fields, enabling the execution of OS [truncated]
AVideo versions prior to 29.0 contain a stored DOM Cross-Site Scripting vulnerability in the YPTSocket plugin. Any unauthenticated remote attacker can execute arbitrary JavaScript in the authenticated origin of every administrator currently viewing a page that renders the YPTSocket online-users debug panel. The vulnerability allows attackers to read non-HttpOnly cookies and the CSRF token rendered into th [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-15T22:16:54.507Z and has not been modified since then. The AVideo platform, specifically versions prior to 29.0, is vulnerable to an unauthenticated Reflected XSS attack through the YouTubeAPI Gallery Pagination feature. This vulnerability allows for arbitrary JavaScript execution under the AVideo o [truncated]
CVE-2026-49279 is a Stored XSS vulnerability in WWBN AVideo versions 29.0 and below. The vulnerability exists through the autoEvalCodeOnHTML parameter in the MessageSQLite WebSocket Handler. An attacker can place the XSS payload in the json key instead of msg, bypassing the sanitization entirely. This allows an authenticated attacker to execute arbitrary JavaScript in any connected user's browser session [truncated]
A vulnerability in AVideo allows for privilege escalation through unguarded permission parameters in the signUp API. This issue has been fixed in version 29.0. The vulnerability is caused by the set_api_signUp method in the API plugin accepting emailVerified, canUpload, canStream, and canCreateMeet parameters from user-supplied input and applying them to newly created accounts without verifying that the r [truncated]
CVE-2026-56347 is a stored cross-site scripting vulnerability in the AVVideo TopMenu plugin through version 26.0. The vulnerability arises from missing output encoding of icon classes, URLs, and text labels in menu item rendering. Attackers can inject malicious JavaScript through unescaped menu item fields, which execute for all site visitors, potentially stealing session cookies or performing unauthorize [truncated]
## Summary CVE-2026-47696 is a **HIGH-severity (CVSS 7.1)** vulnerability in WWBN AVideo, an open-source video platform. In versions 29.0 and earlier, the Authorize.Net payment processing endpoint (`plugin/AuthorizeNet/processPayment.json.php`) contains a critical logic flaw: it **hardcodes `$paymentSuccess = true`** and credits the logged-in user's wallet based solely on an attacker-controlled `amount` P [truncated]
A stored cross-site scripting (XSS) vulnerability exists in WWBN AVideo versions 29.0 and earlier. The application stores category descriptions from user input and renders them as raw HTML in the Gallery view without proper sanitization. An authenticated user with permissions to create or edit categories can inject JavaScript payloads into category descriptions. When other users view the affected Gallery [truncated]
WWBN AVideo 29.0 and earlier contains an unauthenticated arbitrary file read vulnerability. An unauthenticated remote attacker can read arbitrary image files anywhere on disk accessible to the PHP user, including private user-profile photos protected by ACLs, admin-uploaded thumbnails, encrypted-video poster frames, and image content in sibling application directories reachable via directory traversal. Th [truncated]
WWBN AVideo is an open source video platform. In 29.0 and earlier, view/update.php reads $_POST['updateFile'] as a relative path under updatedb/ and passes it to PHP's file() for line-by-line execution as part of a database migration. An authenticated administrator can abuse this to read arbitrary text files reachable from the web-server process.
WWBN AVideo versions 29.0 and earlier contain an unauthenticated user enumeration vulnerability in the objects/mention.json.php endpoint. The endpoint lacks authentication checks (no User::loginCheck() or admin gate) and only validates that the 'term' parameter begins with '@' via preg_match. With a hard-coded rowCount of 10, attackers can enumerate valid usernames without credentials. The vulnerability w [truncated]
WWBN AVideo versions 29.0 and earlier contain a Time-of-Check to Time-of-Use (TOCTOU) vulnerability in SSRF protection mechanisms. The `isSSRFSafeURL()` function in `EpgParser.php`, `plugin/AI/receiveAsync.json.php`, and other locations returns a `$resolvedIP` out-parameter containing the DNS-resolved IP address, but this value is not subsequently used with `CURLOPT_RESOLVE` to pin the connection to that [truncated]
A cross-site request forgery (CSRF) vulnerability exists in WWBN AVideo versions 29.0 and earlier. The endpoint plugin/LoginControl/set.json.php accepts POST requests to disable two-factor authentication (2FA) for the currently authenticated user without requiring CSRF tokens, SameSite cookie enforcement, or re-authentication. An attacker can craft a malicious web page that, when visited by a logged-in vi [truncated]
A stored cross-site scripting (XSS) vulnerability exists in WWBN AVideo versions 29.0 and earlier. The Live plugin's 'YouTube-style' view renders the live transmission's stream key into an HTML class attribute via raw echo without proper output encoding. A user with canStream privileges can persist a malicious stream key containing double-quote characters and event handlers through plugin/Live/saveLive.ph [truncated]
WWBN AVideo versions 29.0 and earlier contain a shell command injection vulnerability in the live streaming notification subsystem. The plugin/Live/on_publish.php file constructs an asynchronous shell command via execAsync() by concatenating user-controlled values into a single-quoted string without applying escapeshellarg() sanitization. An attacker who can influence the $users_id, $m3u8, or $obj->liveTr [truncated]
AVideo, an open-source video platform, is vulnerable to Server-Side Request Forgery (SSRF). In versions 26.0 and prior, an attacker can manipulate the downloadURL value in objects/aVideoEncoder.json.php to bypass SSRF validation, allowing them to exfiltrate SSRF responses as media content. This vulnerability is a result of an incomplete fix for CVE-2026-27732. AVideo administrators and users with authenti [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-04-07T20:16:31.320Z and has not been modified since then. WWBN AVideo versions 26.0 and prior are vulnerable to a security issue that allows an authenticated uploader to fetch attacker-controlled same-origin /videos/... URLs, bypassing traversal scrubbing, and exposing server-local files through the GI [truncated]
CVE-2026-39368 is a vulnerability in WWBN AVideo versions 26.0 and prior. The Live restream log callback flow accepted an attacker-controlled restreamerURL, enabling stored SSRF for authenticated streamers. This vulnerability allows a low-privilege user with streaming permission to store an arbitrary callback URL and trigger server-side requests to loopback or internal HTTP services. The vulnerability has [truncated]
AVideo's EPG feature is vulnerable to stored cross-site scripting (XSS) attacks. An attacker with upload permission can set a video's epg_link to a malicious XML file containing JavaScript payloads in <title> elements, which execute in the browser of unauthenticated visitors to the public EPG page. This vulnerability affects users of AVideo version 26.0 and prior, especially those with upload permissions. [truncated]
The CVE record for CVE-2026-39366 was published on 2026-04-07T20:16:30.510Z and has not been modified since then. The NVD entry is currently Analyzed. This vulnerability affects WWBN AVideo versions 26.0 and prior, allowing attackers to replay legitimate IPN notifications and potentially inflate their wallet balance and renew subscriptions due to a lack of transaction deduplication in the PayPal IPN v1 ha [truncated]
CVE-2026-35452 is a vulnerability in the WWBN AVideo open-source video platform, specifically in versions 26.0 and prior. The plugin/CloneSite/client.log.php endpoint exposes the clone operation log file without requiring authentication. This log contains internal filesystem paths, remote server URLs, and SSH connection metadata. The vulnerability has a CVSS score of 5.3 and a severity rating of MEDIUM. A [truncated]
The WWBN AVideo plugin/API/check.ffmpeg.json.php endpoint allows unauthenticated probing of FFmpeg remote server configuration. This issue affects AVideo versions 26.0 and prior. The vulnerability allows an attacker to determine the connectivity status of the FFmpeg server without providing any authentication credentials. This could potentially lead to information disclosure and further exploitation. Admi [truncated]
AVideo, an open-source video platform, has a diagnostic script (install/test.php) that is accessible via HTTP after installation. This script exposes video viewer statistics, including IP addresses, session IDs, and user agents, to unauthenticated visitors. The issue exists in versions 26.0 and prior. The exposure of viewer statistics could lead to privacy concerns and potential misuse of the exposed info [truncated]
The CVE record for CVE-2026-35181 was published on 2026-04-06T20:16:26.393Z and has not been modified since then. The NVD entry is currently Analyzed. This vulnerability affects WWBN AVideo versions 26.0 and prior, allowing an attacker to modify the video player appearance on the entire platform via a cross-origin POST request due to the lack of CSRF token validation at the player skin configuration endpo [truncated]
The AVideo platform version 26.0 and prior contain a vulnerability enabling cross-origin POST to overwrite platform logo. The site customization endpoint at admin/customize_settings_nativeUpdate.json.php lacks CSRF token validation and writes uploaded logo files to disk before the ORM's domain-based security check executes. Combined with SameSite=None cookie policy, an attacker can overwrite the platform' [truncated]