These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
AVideo's WebRTC plugin has an unauthenticated information disclosure vulnerability. An attacker can request /plugin/WebRTC/status.json.php to obtain sensitive information, including the absolute filesystem path of the WebRTC2RTMP helper binary, the configured WebRTC port, and log file contents. This issue allows unauthorized access to potentially sensitive configuration and log data, which could be used t [truncated]
A remote attacker can inject arbitrary XML into WWBN AVideo when the AD_Server plugin is enabled, allowing for ad injection and cross-origin requests. This issue was unfixed at the time of reporting. The vulnerability is reachable without authentication, and defenders should assess exposure and prioritize verification of the AD_Server plugin configuration and user input validation. The AD_Server plugin wr [truncated]
AVideo's myComments.download.php endpoint contains a CSV formula injection vulnerability. Authenticated users can inject spreadsheet formulas starting with =, +, -, or @ characters, which execute when administrators or video owners open the exported CSV file. This vulnerability allows potential data tampering or unauthorized actions. Defenders and administrators of AVideo instances should assess exposure [truncated]
The WWBN AVideo application contains a cross-site request forgery (CSRF) vulnerability in the playlistRemove.php file. This vulnerability allows attackers to delete playlists by crafting a malicious form that submits a POST request to playlistRemove.php, which can be triggered when a victim visits the attacker's page while logged in. The CVE record was published on 2026-09-11T12:16:54.270Z and has not bee [truncated]
A reflected cross-site scripting vulnerability exists in WWBN AVideo plugin/Gallery/view/Category.php when SubCategorys is enabled. The getBackURL parameter is echoed into an href attribute without HTML encoding, allowing attackers to inject malicious scripts. This vulnerability allows attackers to inject malicious scripts that execute in visitors' browsers when they interact with the Back control. Defend [truncated]
AVideo stored XSS vulnerability via UserGroups::setGroup_name() allows administrators with canAdminUserGroups permission to inject malicious HTML and JavaScript, executing in the browser when other administrators access the user manager interface. This vulnerability can lead to potential injection of malicious HTML and JavaScript in the user manager interface, execution of malicious code in the browser of [truncated]
CVE-2026-89242 debrief: AVideo server-side request forgery vulnerability allows unauthenticated attackers to read local files or access internal services. The vulnerability exists in the _json_decode function, which fetches remote URLs and local file paths without SSRF validation. This allows attackers to POST file paths or HTTP URLs to login.json.php to read local files or access internal services. Defen [truncated]
A reflected cross-site scripting vulnerability exists in WWBN AVideo, specifically in the confirmLivePassword.php file. The vulnerability occurs because the REQUEST_URI is copied into a form action attribute without proper encoding. This allows attackers to craft malicious URLs that can inject event handlers, potentially leading to XSS attacks within the site origin.
A reflected cross-site scripting vulnerability exists in WWBN AVideo plugin/Live/confirmLivePassword.php. The script directly interpolates the unauthenticated GET parameter u into an <img src='...'> attribute without URL- or HTML-encoding. A remote attacker can craft a link to inject an additional tag with an onerror handler, executing arbitrary JavaScript in the site's origin in the browser of any user w [truncated]
A reflected cross-site scripting vulnerability exists in WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1. The showAlertMessage() function inserts the raw Referer header into a JavaScript comment without encoding, allowing attackers to craft a Referer header containing */ to close the comment and inject arbitrary JavaScript. This vulnerability can lead to unauthorized actions or data th [truncated]
AVideo contains an open redirect vulnerability in objects/playlistSort.php due to improper validation of the Referer header. This allows an unauthenticated attacker to redirect a logged-in user's browser to a malicious site for phishing. The vulnerability arises because the playlistSort.php script does not run the automatic CSRF guard, and when the request includes the sort parameter, the script issues a [truncated]
AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/PlayerSkins/seo.php. This vulnerability allows unauthenticated attackers to access password-protected video sources by calling getSources() without password validation, potentially exposing sensitive content. The vulnerability exists in the seo.php endpoint, where attackers can request [truncated]
AVideo's API incompletely sanitizes sensitive user fields in video responses, allowing low-privilege authenticated accounts to request another user's video and receive the owner's email address, account name, and certain flags. This issue affects AVideo instances, particularly those with publicly accessible video sharing features. The vulnerability has a MEDIUM CVSS score of 5.3, indicating a moderate sev [truncated]
A cross-site request forgery vulnerability exists in the CustomizeUser plugin of WWBN AVideo, allowing an unauthenticated remote attacker to forge the ExtraSubscribers count displayed on any user's channel. This is achieved by inducing a logged-in administrator to load a crafted page. The CustomizeUser plugin is enabled by default, and no patched version was available at the time of reporting. The vulnera [truncated]
A cross-site request forgery vulnerability exists in the LoginControl plugin PGP key endpoints of WWBN AVideo, allowing attackers to replace a logged-in victim's PGP 2FA public key. This can cause lockout or enable account takeover if the attacker knows the password. The vulnerability is due to a lack of CSRF token validation, and defenders should assess exposure and implement compensating controls to pre [truncated]
AVideo's LoginControl plugin contains a stored cross-site scripting vulnerability. Attackers with valid login accounts can inject malicious scripts in the User-Agent header, executing in administrator browsers when viewing the Login History page. This vulnerability requires verification of affected versions and exposure, and mitigation is crucial to prevent unauthorized actions and potential privilege esc [truncated]
AVideo fails to validate restream ownership, allowing authenticated users with canStream permission to mint tokens for arbitrary restreams. This could lead to unauthorized publishing to YouTube, Twitch, or RTMP destinations and potential disclosure of stream keys. Defenders should assess exposure, prioritize verification and remediation efforts, and monitor for suspicious activity. AVideo instances requir [truncated]
AVideo through 29.0 contains an information disclosure vulnerability in restreamsActive.json.php that allows authenticated streamers to enumerate source stream keys and identities of all other streamers' active restreams. The endpoint fails to filter results by user ownership, exposing sensitive transmission credentials and streamer identity across all accounts to any user with streaming capability. This [truncated]
AVideo through commit c3edcc274c contains an authorization bypass vulnerability where a session cookie named 'key' with value 'value' overrides the $_REQUEST['key'] parameter in saveLive.php and related endpoints. Attackers can publish to any user's RTMP stream without authentication by using the known constant stream key value to hijack live broadcasts.
The AVideo server-side request forgery vulnerability via the set_api_userImages API endpoint allows authenticated clients to fetch internal URLs, potentially exposing cloud metadata or internal services. This vulnerability, CVE-2026-85164, has a CVSS score of 7.1 and is classified as HIGH severity. The set_api_userImages API endpoint fails to validate profileImg and backgroundImg URLs before fetching them [truncated]
AVideo get.json.php SQL injection allows unauthenticated attackers to infer password hashes and recovery tokens, and disclose database schema. This vulnerability in AVideo's get.json.php endpoint with APIName=channels enables attackers to order results by arbitrary database columns, including users.password and users.recoverPass. The vulnerability allows attackers to infer sensitive user data and disclose [truncated]
AVideo contains a critical authentication failure vulnerability where the video_id_hash credential, a non-expiring and non-revocable bearer token, grants full administrator session access to the video owner's account. This allows attackers who obtain a video_id_hash to authenticate as the video owner with full privileges indefinitely. The credential remains valid even after the owner changes their passwor [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-30T15:16:45.160Z and has not been modified since then. The AVideo application contains a cross-site request forgery vulnerability in sendEmail.json.php. This vulnerability allows attackers to craft malicious web pages that, when visited by authenticated administrators, can send emails with attacker- [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-30T15:16:45.013Z and has not been modified since then. CVE-2026-82646 is an unauthenticated reflected cross-site scripting vulnerability in WWBN AVideo's url2Embed.json.php endpoint. Attackers can inject malicious scripts by supplying URLs with HTML metacharacters, potentially allowing JavaScript ex [truncated]
AVideo, a live streaming platform, contains a critical vulnerability (CVE-2026-82645) that exposes stream credentials through an insecure endpoint. This issue arises from the use of a deterministic IV and no MAC in the encryption of tokens, combined with the lack of user binding, expiry, or authentication tag. The vulnerability allows an unauthenticated attacker to forge valid tokens and disclose arbitrar [truncated]
The CVE-2026-82644 record describes a brute-force rate limiting bypass in WWBN AVideo's enforceRateLimit() function, which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer that silently discards writes for any client identified as a bot by isBot(). Because isBot() treats a missing User-Agent header as a bot by default — and also matches common bot i [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-30T15:16:44.583Z and has not been modified since then. The WWBN AVideo plugin/Live/api/preauthorize.json.php endpoint accepts credentials over GET without rate limiting, allowing attackers to submit correct credentials repeatedly to trigger uncapped two-factor confirmation emails and perform sustain [truncated]
The WWBN AVideo plugin/Live/myLiveControls.save.json.php endpoint is vulnerable to cross-site request forgery (CSRF). An attacker can exploit this vulnerability by luring a logged-in streamer to a malicious page, allowing the attacker to silently change live-channel viewer-redirect settings. This vulnerability affects administrators and users of WWBN AVideo, especially those who manage live channels. The [truncated]
The CVE-2026-81732 vulnerability in AVideo through version 30.0 allows unauthenticated access to user registration statistics via report4.json.php and report4.1.json.php endpoints. Attackers can send GET requests to these endpoints to retrieve daily and cumulative user-registration counts without any session or authorization. This vulnerability has a CVSS score of 6.9 and is classified as MEDIUM severity. [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-27T17:20:57.003Z and has not been modified since then. The NVD entry is currently Deferred. This server-side request forgery vulnerability exists in AVideo before version 24.0, specifically in the isSSRFSafeURL function which fails to extract embedded IPv4 addresses from NAT64, 6to4, and Teredo IPv6 [truncated]