Vendor CVEs
Youphptube
All CVEs
23 total · sorted by risk| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-5127 | 0.08 | — | 0.45 | Oct 25, 2019 | A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. Exploitable unauthenticated command injections exist in YouPHPTube Encoder 2.3 a plugin for providing encoder functionality in YouPHPTube. The… | |||
| CVE-2019-5129 | 0.07 | — | 0.39 | Oct 25, 2019 | A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. Exploitable unauthenticated command injections exist in YouPHPTube Encoder 2.3 a plugin for providing encoder functionality in YouPHPTube. The… | |||
| CVE-2019-5128 | 0.07 | — | 0.30 | Oct 25, 2019 | A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. Exploitable unauthenticated command injections exist in YouPHPTube Encoder 2.3 a plugin for providing encoder functionality in YouPHPTube. The… | |||
| CVE-2019-14430 | 0.03 | — | 0.03 | Aug 20, 2019 | plugin/Audit/Objects/AuditTable.php in YouPHPTube through 7.2 allows SQL Injection. | |||
| CVE-2021-47750 | 0.00 | — | 0.00 | Jan 13, 2026 | YouPHPTube <= 7.8 contains a cross-site scripting vulnerability that allows attackers to inject malicious scripts through the redirectUri parameter in the signup page. Attackers can craft special signup URLs with embedded script tags to execute arbitrary JavaScript in victims'… | |||
| CVE-2021-47749 | 0.00 | — | 0.02 | Jan 13, 2026 | YouPHPTube <= 7.8 contains a local file inclusion vulnerability that allows unauthenticated attackers to access arbitrary files by manipulating the 'lang' parameter in GET requests. Attackers can exploit the path traversal flaw in locale/function.php to include and view PHP… | |||
| CVE-2021-25878 | 0.00 | — | 0.01 | Nov 1, 2021 | AVideo/YouPHPTube 10.0 and prior is affected by multiple reflected Cross Script Scripting vulnerabilities via the videoName parameter which allows a remote attacker to steal administrators' session cookies or perform actions as an administrator. | |||
| CVE-2021-25877 | 0.00 | — | 0.03 | Nov 1, 2021 | AVideo/YouPHPTube 10.0 and prior is affected by Insecure file write. An administrator privileged user is able to write files on filesystem using flag and code variables in file save.php. | |||
| CVE-2021-25876 | 0.00 | — | 0.01 | Nov 1, 2021 | AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross Script Scripting vulnerabilities via the u parameter which allows a remote attacker to steal administrators' session cookies or perform actions as an administrator. | |||
| CVE-2021-25875 | 0.00 | — | 0.01 | Nov 1, 2021 | AVideo/YouPHPTube AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross Script Scripting vulnerabilities via the searchPhrase parameter which allows a remote attacker to steal administrators' session cookies or perform actions as an administrator. | |||
| CVE-2021-25874 | 0.00 | — | 0.02 | Nov 1, 2021 | AVideo/YouPHPTube AVideo/YouPHPTube 10.0 and prior is affected by a SQL Injection SQL injection in the catName parameter which allows a remote unauthenticated attacker to retrieve databases information such as application passwords hashes. | |||
| CVE-2019-18662 | 0.00 | — | 0.02 | Nov 2, 2019 | An issue was discovered in YouPHPTube through 7.7. User input passed through the live_stream_code POST parameter to /plugin/LiveChat/getChat.json.php is not properly sanitized (in getFromChat in plugin/LiveChat/Objects/LiveChatObj.php) before being used to construct a SQL query.… | |||
| CVE-2019-5151 | 0.00 | — | 0.02 | Oct 31, 2019 | An exploitable SQL injection vulnerability exist in YouPHPTube 7.7. A specially crafted unauthenticated HTTP request can cause a SQL injection, possibly leading to denial of service, exfiltration of the database and local file inclusion, which could potentially further lead to… | |||
| CVE-2019-5150 | 0.00 | — | 0.02 | Oct 31, 2019 | An exploitable SQL injection vulnerability exist in YouPHPTube 7.7. When the "VideoTags" plugin is enabled, a specially crafted unauthenticated HTTP request can cause a SQL injection, possibly leading to denial of service, exfiltration of the database and local file inclusion,… | |||
| CVE-2019-5119 | 0.00 | — | 0.01 | Oct 25, 2019 | An exploitable SQL injection vulnerability exist in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially… | |||
| CVE-2019-5120 | 0.00 | — | 0.01 | Oct 25, 2019 | An exploitable SQL injection vulnerability exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially… | |||
| CVE-2019-5114 | 0.00 | — | 0.01 | Oct 25, 2019 | An exploitable SQL injection vulnerability exists in the authenticated portion of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability,… | |||
| CVE-2019-5123 | 0.00 | — | 0.01 | Oct 25, 2019 | Specially crafted web requests can cause SQL injections in YouPHPTube 7.6. An attacker can send a web request with Parameter dir in /objects/pluginSwitch.json.php. | |||
| CVE-2019-5122 | 0.00 | — | 0.01 | Oct 25, 2019 | SQL injection vulnerabilities exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with Parameter name in /objects/pluginSwitch.json.php. | |||
| CVE-2019-5121 | 0.00 | — | 0.01 | Oct 25, 2019 | SQL injection vulnerabilities exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with Parameter uuid in /objects/pluginSwitch.json.php | |||
| CVE-2019-5117 | 0.00 | — | 0.01 | Oct 25, 2019 | Exploitable SQL injection vulnerabilities exists in the authenticated portion of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability,… | |||
| CVE-2019-5116 | 0.00 | — | 0.01 | Oct 25, 2019 | An exploitable SQL injection vulnerability exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause a SQL injection. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially… | |||
| CVE-2019-16124 | 0.00 | — | 0.28 | Sep 9, 2019 | In YouPHPTube 7.4, the file install/checkConfiguration.php has no access control, which leads to everyone being able to edit the configuration file, and insert malicious PHP code. |
- CVE-2019-5127Oct 25, 2019risk 0.08cvss —epss 0.45
A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. Exploitable unauthenticated command injections exist in YouPHPTube Encoder 2.3 a plugin for providing encoder functionality in YouPHPTube. The…
- CVE-2019-5129Oct 25, 2019risk 0.07cvss —epss 0.39
A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. Exploitable unauthenticated command injections exist in YouPHPTube Encoder 2.3 a plugin for providing encoder functionality in YouPHPTube. The…
- CVE-2019-5128Oct 25, 2019risk 0.07cvss —epss 0.30
A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. Exploitable unauthenticated command injections exist in YouPHPTube Encoder 2.3 a plugin for providing encoder functionality in YouPHPTube. The…
- CVE-2019-14430Aug 20, 2019risk 0.03cvss —epss 0.03
plugin/Audit/Objects/AuditTable.php in YouPHPTube through 7.2 allows SQL Injection.
- CVE-2021-47750Jan 13, 2026risk 0.00cvss —epss 0.00
YouPHPTube <= 7.8 contains a cross-site scripting vulnerability that allows attackers to inject malicious scripts through the redirectUri parameter in the signup page. Attackers can craft special signup URLs with embedded script tags to execute arbitrary JavaScript in victims'…
- CVE-2021-47749Jan 13, 2026risk 0.00cvss —epss 0.02
YouPHPTube <= 7.8 contains a local file inclusion vulnerability that allows unauthenticated attackers to access arbitrary files by manipulating the 'lang' parameter in GET requests. Attackers can exploit the path traversal flaw in locale/function.php to include and view PHP…
- CVE-2021-25878Nov 1, 2021risk 0.00cvss —epss 0.01
AVideo/YouPHPTube 10.0 and prior is affected by multiple reflected Cross Script Scripting vulnerabilities via the videoName parameter which allows a remote attacker to steal administrators' session cookies or perform actions as an administrator.
- CVE-2021-25877Nov 1, 2021risk 0.00cvss —epss 0.03
AVideo/YouPHPTube 10.0 and prior is affected by Insecure file write. An administrator privileged user is able to write files on filesystem using flag and code variables in file save.php.
- CVE-2021-25876Nov 1, 2021risk 0.00cvss —epss 0.01
AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross Script Scripting vulnerabilities via the u parameter which allows a remote attacker to steal administrators' session cookies or perform actions as an administrator.
- CVE-2021-25875Nov 1, 2021risk 0.00cvss —epss 0.01
AVideo/YouPHPTube AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross Script Scripting vulnerabilities via the searchPhrase parameter which allows a remote attacker to steal administrators' session cookies or perform actions as an administrator.
- CVE-2021-25874Nov 1, 2021risk 0.00cvss —epss 0.02
AVideo/YouPHPTube AVideo/YouPHPTube 10.0 and prior is affected by a SQL Injection SQL injection in the catName parameter which allows a remote unauthenticated attacker to retrieve databases information such as application passwords hashes.
- CVE-2019-18662Nov 2, 2019risk 0.00cvss —epss 0.02
An issue was discovered in YouPHPTube through 7.7. User input passed through the live_stream_code POST parameter to /plugin/LiveChat/getChat.json.php is not properly sanitized (in getFromChat in plugin/LiveChat/Objects/LiveChatObj.php) before being used to construct a SQL query.…
- CVE-2019-5151Oct 31, 2019risk 0.00cvss —epss 0.02
An exploitable SQL injection vulnerability exist in YouPHPTube 7.7. A specially crafted unauthenticated HTTP request can cause a SQL injection, possibly leading to denial of service, exfiltration of the database and local file inclusion, which could potentially further lead to…
- CVE-2019-5150Oct 31, 2019risk 0.00cvss —epss 0.02
An exploitable SQL injection vulnerability exist in YouPHPTube 7.7. When the "VideoTags" plugin is enabled, a specially crafted unauthenticated HTTP request can cause a SQL injection, possibly leading to denial of service, exfiltration of the database and local file inclusion,…
- CVE-2019-5119Oct 25, 2019risk 0.00cvss —epss 0.01
An exploitable SQL injection vulnerability exist in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially…
- CVE-2019-5120Oct 25, 2019risk 0.00cvss —epss 0.01
An exploitable SQL injection vulnerability exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially…
- CVE-2019-5114Oct 25, 2019risk 0.00cvss —epss 0.01
An exploitable SQL injection vulnerability exists in the authenticated portion of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability,…
- CVE-2019-5123Oct 25, 2019risk 0.00cvss —epss 0.01
Specially crafted web requests can cause SQL injections in YouPHPTube 7.6. An attacker can send a web request with Parameter dir in /objects/pluginSwitch.json.php.
- CVE-2019-5122Oct 25, 2019risk 0.00cvss —epss 0.01
SQL injection vulnerabilities exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with Parameter name in /objects/pluginSwitch.json.php.
- CVE-2019-5121Oct 25, 2019risk 0.00cvss —epss 0.01
SQL injection vulnerabilities exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with Parameter uuid in /objects/pluginSwitch.json.php
- CVE-2019-5117Oct 25, 2019risk 0.00cvss —epss 0.01
Exploitable SQL injection vulnerabilities exists in the authenticated portion of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability,…
- CVE-2019-5116Oct 25, 2019risk 0.00cvss —epss 0.01
An exploitable SQL injection vulnerability exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause a SQL injection. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially…
- CVE-2019-16124Sep 9, 2019risk 0.00cvss —epss 0.28
In YouPHPTube 7.4, the file install/checkConfiguration.php has no access control, which leads to everyone being able to edit the configuration file, and insert malicious PHP code.