Packagist (Composer) package
wwbn/avideo
pkg:composer/wwbn/avideo
Vulnerabilities (133)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-27732 | — | <= 21.0.0 | — | Feb 24, 2026 | WWBN AVideo is an open source video platform. Prior to version 22.0, the `aVideoEncoder.json.php` API endpoint accepts a `downloadURL` parameter and fetches the referenced resource server-side without proper validation or an allow-list. This allows authenticated users to trigger | ||
| CVE-2026-27568 | — | < 21.0 | 21.0 | Feb 24, 2026 | WWBN AVideo is an open source video platform. Prior to version 21.0, AVideo allows Markdown in video comments and uses Parsedown (v1.7.4) without Safe Mode enabled. Markdown links are not sufficiently sanitized, allowing `javascript:` URIs to be rendered as clickable links. An au | ||
| CVE-2024-34899 | — | < 14.3 | 14.3 | May 13, 2024 | WWBN AVideo 12.4 is vulnerable to Cross Site Scripting (XSS). | ||
| CVE-2024-31819 | — | >= 12.4, < 14.3 | 14.3 | Apr 10, 2024 | An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath parameter of the submitIndex.php component. | ||
| CVE-2023-50172 | — | <= 12.4 | — | Jan 10, 2024 | A recovery notification bypass vulnerability exists in the userRecoverPass.php captcha validation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to the silent creation of a recovery pass code for any user. | ||
| CVE-2023-49810 | — | <= 12.4 | — | Jan 10, 2024 | A login attempt restriction bypass vulnerability exists in the checkLoginAttempts functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to captcha bypass, which can be abused by an attacker to brute force user credentials. An attacke | ||
| CVE-2023-49599 | — | <= 12.4 | — | Jan 10, 2024 | An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted series of HTTP requests can lead to privilege escalation. An attacker can gather system information via HTTP requests and brute force | ||
| CVE-2023-32073 | — | <= 12.4 | — | May 12, 2023 | WWBN AVideo is an open source video platform. In versions 12.4 and prior, a command injection vulnerability exists at `plugin/CloneSite/cloneClient.json.php` which allows Remote Code Execution if you CloneSite Plugin. This is a bypass to the fix for CVE-2023-30854, which affects | ||
| CVE-2023-30860 | — | < 12.4 | 12.4 | May 8, 2023 | WWBN AVideo is an open source video platform. In AVideo prior to version 12.4, a normal user can make a Meeting Schedule where the user can invite another user in that Meeting, but it does not properly sanitize the malicious characters when creating a Meeting Room. This allows at | ||
| CVE-2023-30854 | — | < 12.4 | 12.4 | Apr 28, 2023 | AVideo is an open source video platform. Prior to version 12.4, an OS Command Injection vulnerability in an authenticated endpoint `/plugin/CloneSite/cloneClient.json.php` allows attackers to achieve Remote Code Execution. This issue is fixed in version 12.4. | ||
| CVE-2023-25313 | — | < 12.4 | 12.4 | Apr 25, 2023 | OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbitrary code via the video link field to the Embed a video link feature. | ||
| CVE-2022-27463 | — | <= 11.6 | — | Apr 5, 2022 | Open redirect vulnerability in objects/login.json.php in WWBN AVideo through 11.6, allows attackers to arbitrarily redirect users from a crafted url to the login page. | ||
| CVE-2020-23489 | — | < 8.9 | 8.9 | Nov 16, 2020 | The import.json.php file before 8.9 for Avideo is vulnerable to a File Deletion vulnerability. This allows the deletion of configuration.php, which leads to certain privilege checks not being in place, and therefore a user can escalate privileges to admin. |
- CVE-2026-27732Feb 24, 2026affected <= 21.0.0
WWBN AVideo is an open source video platform. Prior to version 22.0, the `aVideoEncoder.json.php` API endpoint accepts a `downloadURL` parameter and fetches the referenced resource server-side without proper validation or an allow-list. This allows authenticated users to trigger
- CVE-2026-27568Feb 24, 2026affected < 21.0fixed 21.0
WWBN AVideo is an open source video platform. Prior to version 21.0, AVideo allows Markdown in video comments and uses Parsedown (v1.7.4) without Safe Mode enabled. Markdown links are not sufficiently sanitized, allowing `javascript:` URIs to be rendered as clickable links. An au
- CVE-2024-34899May 13, 2024affected < 14.3fixed 14.3
WWBN AVideo 12.4 is vulnerable to Cross Site Scripting (XSS).
- CVE-2024-31819Apr 10, 2024affected >= 12.4, < 14.3fixed 14.3
An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath parameter of the submitIndex.php component.
- CVE-2023-50172Jan 10, 2024affected <= 12.4
A recovery notification bypass vulnerability exists in the userRecoverPass.php captcha validation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to the silent creation of a recovery pass code for any user.
- CVE-2023-49810Jan 10, 2024affected <= 12.4
A login attempt restriction bypass vulnerability exists in the checkLoginAttempts functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to captcha bypass, which can be abused by an attacker to brute force user credentials. An attacke
- CVE-2023-49599Jan 10, 2024affected <= 12.4
An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted series of HTTP requests can lead to privilege escalation. An attacker can gather system information via HTTP requests and brute force
- CVE-2023-32073May 12, 2023affected <= 12.4
WWBN AVideo is an open source video platform. In versions 12.4 and prior, a command injection vulnerability exists at `plugin/CloneSite/cloneClient.json.php` which allows Remote Code Execution if you CloneSite Plugin. This is a bypass to the fix for CVE-2023-30854, which affects
- CVE-2023-30860May 8, 2023affected < 12.4fixed 12.4
WWBN AVideo is an open source video platform. In AVideo prior to version 12.4, a normal user can make a Meeting Schedule where the user can invite another user in that Meeting, but it does not properly sanitize the malicious characters when creating a Meeting Room. This allows at
- CVE-2023-30854Apr 28, 2023affected < 12.4fixed 12.4
AVideo is an open source video platform. Prior to version 12.4, an OS Command Injection vulnerability in an authenticated endpoint `/plugin/CloneSite/cloneClient.json.php` allows attackers to achieve Remote Code Execution. This issue is fixed in version 12.4.
- CVE-2023-25313Apr 25, 2023affected < 12.4fixed 12.4
OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbitrary code via the video link field to the Embed a video link feature.
- CVE-2022-27463Apr 5, 2022affected <= 11.6
Open redirect vulnerability in objects/login.json.php in WWBN AVideo through 11.6, allows attackers to arbitrarily redirect users from a crafted url to the login page.
- CVE-2020-23489Nov 16, 2020affected < 8.9fixed 8.9
The import.json.php file before 8.9 for Avideo is vulnerable to a File Deletion vulnerability. This allows the deletion of configuration.php, which leads to certain privilege checks not being in place, and therefore a user can escalate privileges to admin.
Page 7 of 7