These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
AVideo stored XSS vulnerability allows users with upload permission to inject malicious script via trailer1 URL, executed in victims' browsers when rendered unescaped in YouPHPFlix2 templates and channel playlists. This critical vulnerability enables attackers to break out of onclick strings or iframe src attributes, potentially leading to JavaScript execution. Defenders responsible for AVideo installatio [truncated]
AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows authenticated uploaders to inject HTML by submitting doubly-encoded entities in video titles. Because safeString() strips tags before decoding entities and runs twice via setTitle() and save(), attackers can store markup that executes in trending, gallery, embed, and playlist pages.
AVideo before 29.1.0 contains a stored cross-site scripting vulnerability in the video trailer1 field. Attackers with video upload permission can store HTML entity-encoded payloads that bypass isValidURL() validation and are decoded by the browser to break out of the JavaScript string, executing arbitrary code in any visitor's session including administrators.
A vulnerability in WWBN AVideo allows unauthenticated remote attackers to send arbitrary verification emails, enumerate accounts, and write live password-recovery tokens to targeted accounts due to a broken access control flaw in objects/userVerifyEmail.php. This flaw disables the login requirement, takes users_id directly from the query string, and calls User::sendVerificationLink() with no session requi [truncated]
AVideo LoginControl contains an authentication bypass vulnerability in the PGP second factor verification. This issue allows attackers with a victim's password to bypass the second factor by sending a parameter-less GET request to verifyChallenge.json.php. The vulnerability arises from the comparison of challenge responses using loose equality against an uninitialized session variable, which evaluates nul [truncated]
AVideo uses a cryptographically weak pseudo-random number generator for account activation and login pairing codes, allowing an unauthenticated remote attacker to guess and redeem a valid code to obtain the target account's email address and a credential accepted in place of the account password for one year, resulting in account takeover. The vulnerability is caused by the use of a weak pseudo-random num [truncated]
AVideo uses weak uniqid() values for RTMP publish keys, allowing attackers to brute-force stream keys and broadcast as channel owners. This vulnerability affects AVideo's LiveTransmition feature, reducing key entropy to approximately one million possibilities per creation second. Defenders should assess exposure and prioritize verification of AVideo configurations and LiveTransmition features to prevent u [truncated]
AVideo through version 29.0 fails to verify video access permissions in the set_api_comment function, allowing authenticated users to post comments on password-protected and group-restricted videos. This vulnerability has a CVSS score of 5.3 and is publicly disclosed. Defenders should assess exposure and verify video access permissions to prevent unauthorized content modification or information disclosure [truncated]
AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to validate video access permissions in the API like endpoint, allowing logged-in users to vote on password-protected and group-restricted videos. This vulnerability enables attackers to submit like and dislike requests to increment vote counters on videos they cannot watch by calling the set.json.php endpoint with APIName paramet [truncated]
AVideo through 29.0 (current revision e01e41ecc) contains a stored cross-site scripting vulnerability. The unauthenticated view-counter endpoint objects/videoAddViewCount.json.php reaches VideoStatistic::save(), which writes the caller's User-Agent (via getUserAgentInfo(), which returns unrecognized agent strings verbatim) directly into the `app` column of the videos_statistics table without invoking the [truncated]
AVideo through 29.0 contains a race condition in the enforceRateLimit() function that fails to atomically increment rate limit counters, allowing attackers to bypass all rate limits including login brute-force protection by issuing concurrent requests. This vulnerability can lead to increased authentication attempts or brute-force attacks, potentially causing denial-of-service or other security issues. De [truncated]
AVideo through version 29.0 is vulnerable to cross-site request forgery due to a weakness in the videoAddNew.json.php file. This allows an attacker to modify video records, including ownership transfer and deletion of user-group access restrictions, by luring an authenticated user with upload rights to visit a crafted page. The vulnerability exists because the file disables AVideo's automatic CSRF guard a [truncated]
CVE-2026-92581 is a vulnerability in AVideo that allows authenticated attackers to drive video like counts arbitrarily negative by sending array-typed like parameters followed by ordinary requests. This corruption persists in the denormalized counter until manual repair. The vulnerability affects AVideo instances, specifically impacting the like counter functionality. Defenders should assess exposure and [truncated]
The AVideo CloneSite plugin is vulnerable to stored OS command injection via an SSH password and CSRF. This occurs in plugin/CloneSite/cloneClient.json.php, where the stored SSH password is substituted into a command string without proper escaping. An unauthenticated remote attacker can lure an authenticated administrator into planting a malicious password and attacker-controlled cloneSiteURL, leading to [truncated]
AVideo plugin CSRF exemption vulnerability allows unauthenticated logout of authenticated users through a hardcoded allowlist of exempt basenames without directory context in the autoCSRFGuard() function, specifically affecting the LoginWordPress plugin file login.json.php. Defenders should assess exposure and validate mechanisms to prevent unauthorized logout. The vulnerability's impact on authentication [truncated]
AVideo authentication bypass vulnerability allows attackers to authenticate as any user using the stored password hash, completely bypassing password verification. This vulnerability affects AVideo installations, particularly those responsible for authentication and password management systems. The vulnerability has a high impact on system security, allowing unauthorized access to sensitive information. D [truncated]
AVideo API get_api_video endpoint has a broken access control vulnerability allowing anonymous retrieval of user-group-restricted videos with owner PII. This vulnerability impacts user privacy and security, as attackers can query videos by their public slug to bypass group restrictions and retrieve sensitive user fields including email, phone, address, birth date, and administrator status. Defenders shoul [truncated]
AVideo through 29.0 contains an unauthenticated server-side request forgery vulnerability in the check_site_availability function that accepts attacker-controlled HTTP Host headers. Attackers can send requests to submitIndex.php or ajax.php with arbitrary Host headers to probe internal network hosts and ports, following redirects without authentication.
AVideo playlist endpoint allows unauthenticated access to private content. The video_from_program API endpoint in AVideo fails to validate playlist ownership, allowing unauthenticated access to private playlist contents. This vulnerability may allow attackers to enumerate private playlist names, owner information, and video titles, including password-protected content. Defenders and administrators of AVid [truncated]
The AVideo like.json.php endpoint fails to validate video access permissions, allowing logged-in users to record likes on password-protected and group-restricted videos. This vulnerability enables attackers to submit like requests for videos they cannot watch, potentially incrementing like counters and bypassing access controls. Defenders should assess exposure and verify video access controls to mitigate [truncated]
AVideo plugin/TopMenu/menus.json.php endpoint discloses menu data without authentication, allowing attackers to read inactive and admin-only menu names. This vulnerability impacts AVideo deployments, as it enables unauthenticated access to sensitive menu information. Defenders should assess the exposure of their AVideo instances and prioritize remediation to prevent potential unauthorized access to menu d [truncated]
AVideo through 29.0 contains an insecure direct object reference (IDOR) vulnerability in objects/categoryDeleteAssets.json.php. The endpoint validates only the Category::canCreateCategory() capability and a CSRF nonce before passing the attacker-supplied $_REQUEST['id'] to Category::deleteAssets(), which recursively removes {systemRootPath}videos/categories/assets/{id}/. It omits the Category::userCanEdit [truncated]
A stored cross-site scripting vulnerability exists in the Bookmark plugin of AVideo, allowing a video owner to inject malicious scripts via the bookmark name parameter. This payload is executed for every visitor of that video on the AVideo origin. The vulnerability has a CVSS score of 9.3 and critical severity. Defenders should verify and remediate this vulnerability, especially for AVideo instances with [truncated]
AVideo's LoginControl plugin contains a stored cross-site scripting vulnerability. An authenticated attacker can inject malicious JavaScript by submitting a crafted PGP public key, which executes in an administrator's session when viewing the user's profile tab. This vulnerability exists in AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1. The plugin fails to HTML-encode PGP public keys echo [truncated]
A stored cross-site scripting vulnerability exists in AVideo's CustomizeUser plugin, where the field_name parameter is stored raw without sanitization. This allows administrators to inject malicious scripts via the add.json.php endpoint, which execute when viewing extra info pages or profile forms that render the typeToHTML function. The vulnerability has a CVSS score of 9.3 and is considered critical. De [truncated]
A stored cross-site scripting vulnerability exists in WWBN AVideo, specifically in the user 'donationLink' profile field. An authenticated user can inject malicious JavaScript code, which can be executed in the browser of any visitor who views the attacker's videos and interacts with the donation button. This vulnerability allows an attacker to potentially execute arbitrary code, leading to phishing or fu [truncated]
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 has a vulnerability in addLiveLink.php that allows authenticated users to modify other users' LiveLinks due to a lack of ownership verification. This can lead to unauthorized modifications of LiveLink HLS source and metadata, potentially redirecting viewers to attacker-controlled media. Defenders should assess exposure and prioritize verificat [truncated]
AVideo plugin/AD_Server/log.php fails to validate ad impressions, allowing logged-in users to submit arbitrary label values that trigger unverified wallet credits to campaign video owners. This vulnerability can be exploited by repeatedly POSTing label=start requests to mint YPTWallet balance for any campaign video without proof an ad actually played, potentially resulting in unauthorized wallet credits f [truncated]
AVideo's unauthenticated file read vulnerability in the getRecordedFile.php endpoint allows attackers to download recorded live video files without authentication or authorization, potentially leading to unauthorized access and data exposure. This vulnerability affects AVideo installations and systems that interact with recorded video files. Defenders should assess exposure and implement compensating cont [truncated]
A stored cross-site scripting vulnerability exists in the YPTWallet plugin of AVideo, allowing attackers to perform administrative actions via same-origin fetch requests when administrators view pending withdrawal requests. This vulnerability is particularly concerning because it can be exploited by attackers to perform administrative actions, potentially leading to unauthorized access to sensitive inform [truncated]