avideo - Robuta Search

https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-40907/ WWBN AVideo has an IDOR in Live Restreams list.json.php Exposes Other Users' Stream Keys and OAuth... CVE-2026-40907 WWBN AVideo has an IDOR in Live Restreams list.json.php Exposes Other Users' Stream Keys and OAuth Tokens: The endpoint... https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-35452/ AVideo: Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php |... CVE-2026-35452 AVideo: Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php: The plugin/CloneSite/client.log.php endpoint serves... information disclosure https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-41060/ WWBN AVideo has a SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL | GitLab... CVE-2026-41060 WWBN AVideo has a SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL: The isSSRFSafeURL() function in... https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-41055/ WWBN AVideo has an incomplete fix for CVE-2026-33039: SSRF | GitLab Advisory Database (GLAD) CVE-2026-41055 WWBN AVideo has an incomplete fix for CVE-2026-33039: SSRF: The incomplete SSRF fix in AVideo's LiveLinks proxy adds isSSRFSafeURL() validation... https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-28502/ AVideo has Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction | GitLab Advisory... CVE-2026-28502 AVideo has Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction: An authenticated Remote Code Execution (RCE) vulnerability was... remote code execution https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-33685/ AVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign... CVE-2026-33685 AVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User Data: The... https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-33352/ AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass)... CVE-2026-33352 AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass): An unauthenticated SQL injection... sql injection https://advisories.gitlab.com/composer/wwbn/avideo/GHSA-mwjc-5j4x-r686/ AVideo has an unauthenticated decrypt oracle leaking any ciphertext | GitLab Advisory Database... GHSA-mwjc-5j4x-r686 AVideo has an unauthenticated decrypt oracle leaking any ciphertext: The API plugin exposes a decryptString action without any... https://advisories.gitlab.com/composer/wwbn/avideo/GHSA-pq8p-wc4f-vg7j/ WWBN AVideo has an incomplete fix for CVE-2026-33502: Command Injection | GitLab Advisory Database... GHSA-pq8p-wc4f-vg7j WWBN AVideo has an incomplete fix for CVE-2026-33502: Command Injection: The incomplete fix for AVideo's test.php adds escapeshellarg for... https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-41058/ WWBN AVideo has an incomplete fix for CVE-2026-33293: Path Traversal | GitLab Advisory Database... CVE-2026-41058 WWBN AVideo has an incomplete fix for CVE-2026-33293: Path Traversal: The incomplete fix for AVideo's CloneSite deleteDump parameter does not... https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-33035/ Unauthenticated Reflected XSS via innerHTML in AVideo | GitLab Advisory Database (GLAD) CVE-2026-33035 Unauthenticated Reflected XSS via innerHTML in AVideo: AVideo contains a reflected XSS vulnerability that allows unauthenticated attackers to... reflected xss via innerhtml https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-35179/ AVideo: Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php | GitLab Advisory... CVE-2026-35179 AVideo: Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php: The SocialMediaPublisher plugin exposes a... graph api https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-33500/ AVideo - Incomplete Fix for CVE-2026-27568: Stored XSS via Markdown `javascript:` URI Bypasses... CVE-2026-33500 AVideo - Incomplete Fix for CVE-2026-27568: Stored XSS via Markdown `javascript:` URI Bypasses ParsedownSafeWithLinks Sanitization: The fix for... https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-33681/ AVideo has Path Traversal in pluginRunDatabaseScript.json.php Enables Arbitrary SQL File Execution... CVE-2026-33681 AVideo has Path Traversal in pluginRunDatabaseScript.json.php Enables Arbitrary SQL File Execution via Unsanitized Plugin Name: The... https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-43884/ AVideo has SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL() | GitLab... CVE-2026-43884 AVideo has SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL(): Two endpoints in AVideo call isSSRFSafeURL() to... https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-40911/ WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript... CVE-2026-40911 WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks: The... https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-39369/ WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public... CVE-2026-39369 WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLs:... https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-34716/ AVideo: DOM XSS via Unsanitized Display Name in WebSocket Call Notification | GitLab Advisory... CVE-2026-34716 AVideo: DOM XSS via Unsanitized Display Name in WebSocket Call Notification: The AVideo YPTSocket plugin's caller feature renders incoming call... https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-33039/ AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy | GitLab... CVE-2026-33039 AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy: The plugin/LiveLinks/proxy.php endpoint validates... https://advisories.gitlab.com/composer/wwbn/avideo/GHSA-gmpc-fxg2-vcmq/ AVideo has Stored XSS via Unescaped Menu Item Fields in TopMenu Plugin | GitLab Advisory Database... GHSA-gmpc-fxg2-vcmq AVideo has Stored XSS via Unescaped Menu Item Fields in TopMenu Plugin: The TopMenu plugin renders menu item fields (icon classes, URLs,... https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-33649/ AVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary... CVE-2026-33649 AVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission Modification: The... https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-43876/ AVideo: HTML Injection in notifySubscribers.json.php Allows Platform-Branded Phishing Emails to... CVE-2026-43876 AVideo: HTML Injection in notifySubscribers.json.php Allows Platform-Branded Phishing Emails to Channel Subscribers:... https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-33648/ AVideo Vulnerable to OS Command Injection via Unsanitized `users_id` and... CVE-2026-33648 AVideo Vulnerable to OS Command Injection via Unsanitized `users_id` and `liveTransmitionHistory_id` in Restreamer Log File Path: The restreamer... os command injection avideo vulnerable https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-41062/ WWBN AVideo has an Incomplete fix: Directory traversal bypass via query string in ReceiveImage... CVE-2026-41062 WWBN AVideo has an Incomplete fix: Directory traversal bypass via query string in ReceiveImage downloadURL parameters: The directory traversal... https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-35450/ AVideo: Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php | GitLab... CVE-2026-35450 AVideo: Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php: The plugin/API/check.ffmpeg.json.php endpoint probes... remote server status disclosure https://advisories.gitlab.com/composer/wwbn/avideo/GHSA-8fw8-q79c-fp9m/ AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP) |... GHSA-8fw8-q79c-fp9m AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP): An unauthenticated API endpoint... https://advisories.gitlab.com/composer/wwbn/avideo/GHSA-ff5q-cc22-fgp4/ WWBN AVideo has a CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true)... GHSA-ff5q-cc22-fgp4 WWBN AVideo has a CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) Exposes Authenticated API Responses: The... https://advisories.gitlab.com/composer/wwbn/avideo/GHSA-8pv3-29pp-pf8f/ WWBN AVideo has Stored XSS via Unanchored Duration Regex in Video Encoder Receiver | GitLab... GHSA-8pv3-29pp-pf8f WWBN AVideo has Stored XSS via Unanchored Duration Regex in Video Encoder Receiver: The isValidDuration() regex at objects/video.php:918... https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-34731/ AVideo: Unauthenticated Live Stream Termination via RTMP Callback on_publish_done.php | GitLab... CVE-2026-34731 AVideo: Unauthenticated Live Stream Termination via RTMP Callback on_publish_done.php: The AVideo on_publish_done.php endpoint in the Live... https://advisories.gitlab.com/pkg/composer/wwbn/avideo/GMS-2023-226/ https://advisories.gitlab.com/composer/wwbn/avideo/GMS-2023-226/ https advisories gitlab composer avideo https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-34369/ AVideo has Video Password Protection Bypass via API Endpoints Returning Full Playback Sources... CVE-2026-34369 AVideo has Video Password Protection Bypass via API Endpoints Returning Full Playback Sources Without Password Verification: The... https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-33647/ AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload... CVE-2026-33647 AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload: The ImageGallery::saveFile() method... https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-33488/ AVideo has a PGP 2FA Bypass via Cryptographically Broken 512-bit RSA Key Generation in LoginControl... CVE-2026-33488 AVideo has a PGP 2FA Bypass via Cryptographically Broken 512-bit RSA Key Generation in LoginControl Plugin: The createKeys() function in the... https://advisories.gitlab.com/composer/wwbn/avideo/GHSA-vvfw-4m39-fjqf/ WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover... GHSA-vvfw-4m39-fjqf WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials:... https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-40909/ WWBN AVideo has a Path Traversal in Locale Save Endpoint Enables Arbitrary PHP File Write to Any... CVE-2026-40909 WWBN AVideo has a Path Traversal in Locale Save Endpoint Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE): The locale save... https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-33483/ AVideo Affected by Unauthenticated Disk Space Exhaustion via Unlimited Temp File Creation in... CVE-2026-33483 AVideo Affected by Unauthenticated Disk Space Exhaustion via Unlimited Temp File Creation in aVideoEncoderChunk.json.php: The... https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-33038/ AVideo affected by unauthenticated application takeover via exposed web installer on uninitialized... CVE-2026-33038 AVideo affected by unauthenticated application takeover via exposed web installer on uninitialized deployments: The... https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-34740/ AVideo: Stored SSRF via Video EPG Link Missing isSSRFSafeURL() Validation | GitLab Advisory... CVE-2026-34740 AVideo: Stored SSRF via Video EPG Link Missing isSSRFSafeURL() Validation: The EPG (Electronic Program Guide) link feature in AVideo allows... https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-34613/ AVideo: CSRF on Plugin Enable/Disable Endpoint Allows Disabling Security Plugins | GitLab Advisory... CVE-2026-34613 AVideo: CSRF on Plugin Enable/Disable Endpoint Allows Disabling Security Plugins: The AVideo endpoint objects/pluginSwitch.json.php allows... https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-40928/ WWBN AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment... CVE-2026-40928 WWBN AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset... https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-33651/ AVideo has a Blind SQL Injection in Live Schedule Reminder via Unsanitized live_schedule_id in... CVE-2026-33651 AVideo has a Blind SQL Injection in Live Schedule Reminder via Unsanitized live_schedule_id in Scheduler_commands::getAllActiveOrToRepeat(): The... blind sql injection https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-33043/ AVideo affected by Session Hijacking via Unauthenticated Session ID Disclosure with Permissive CORS... CVE-2026-33043 AVideo affected by Session Hijacking via Unauthenticated Session ID Disclosure with Permissive CORS: /objects/phpsessionid.json.php exposes the... by session https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-34732/ AVideo: Missing Authentication in CreatePlugin list.json.php Template Affects 21 Endpoints | GitLab... CVE-2026-34732 AVideo: Missing Authentication in CreatePlugin list.json.php Template Affects 21 Endpoints: The AVideo CreatePlugin template for list.json.php... https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-33296/ AVideo has an Open Redirect via Unvalidated redirectUri in userLogin.php | GitLab Advisory Database... CVE-2026-33296 AVideo has an Open Redirect via Unvalidated redirectUri in userLogin.php: WWBN/AVideo contains an open redirect vulnerability in the login flow... https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-39368/ WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services |... CVE-2026-39368 WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services: The Live restream log callback flow accepted an... https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-34368/ AVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalance |... CVE-2026-34368 AVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalance: The transferBalance() method in... https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-34394/ AVideo's CSRF on Admin Plugin Configuration Enables Payment Credential Hijacking | GitLab Advisory... CVE-2026-34394 AVideo's CSRF on Admin Plugin Configuration Enables Payment Credential Hijacking: AVideo's admin plugin configuration endpoint... https://video.chiesacattolica.it/user?redirectUri=https%3A%2F%2Fvideo.chiesacattolica.it%2F My Account · AVideo my account avideo https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-43873/ AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php`... CVE-2026-43873 AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured... https://advisories.gitlab.com/composer/wwbn/avideo/GHSA-gph2-j4c9-vhhr/ WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript... GHSA-gph2-j4c9-vhhr WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks: The... https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-29093/ AVideo: Unauthenticated PHP session store exposed to host network via published memcached port |... CVE-2026-29093 AVideo: Unauthenticated PHP session store exposed to host network via published memcached port: The official docker-compose.yml publishes the... https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-39370/ WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable... CVE-2026-39370 WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration (Incomplete fix for... https://advisories.gitlab.com/composer/wwbn/avideo/GHSA-gpgp-w4x2-h3h7/ WWBN AVideo has an IDOR in Live Restreams list.json.php Exposes Other Users' Stream Keys and OAuth... GHSA-gpgp-w4x2-h3h7 WWBN AVideo has an IDOR in Live Restreams list.json.php Exposes Other Users' Stream Keys and OAuth Tokens: The endpoint... https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-43882/ AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event... CVE-2026-43882 AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event Spoofing: The unauthenticated... https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-33683/ AVideo vulnerable to Stored XSS via html_entity_decode() Reversing xss_esc() Sanitization in... CVE-2026-33683 AVideo vulnerable to Stored XSS via html_entity_decode() Reversing xss_esc() Sanitization in Channel About Field: A sanitization... html entity decode https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-34737/ AVideo: Arbitrary Stripe Subscription Cancellation via Debug Endpoint and retrieveSubscriptions()... CVE-2026-34737 AVideo: Arbitrary Stripe Subscription Cancellation via Debug Endpoint and retrieveSubscriptions() Bug: The StripeYPT plugin includes a test.php... subscription cancellation avideo arbitrary stripe via https://advisories.gitlab.com/composer/wwbn/avideo/GHSA-793q-xgj6-7frp/ WWBN AVideo has an incomplete fix for CVE-2026-33039: SSRF | GitLab Advisory Database (GLAD) GHSA-793q-xgj6-7frp WWBN AVideo has an incomplete fix for CVE-2026-33039: SSRF: The incomplete SSRF fix in AVideo's LiveLinks proxy adds isSSRFSafeURL()... https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-33717/ AVideo: Remote Code Execution via PHP Temp File in Encoder downloadURL | GitLab Advisory Database... CVE-2026-33717 AVideo: Remote Code Execution via PHP Temp File in Encoder downloadURL: The downloadVideoFromDownloadURL() function in... https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-41056/ WWBN AVideo has CORS Origin Reflection with Credentials on Sensitive API Endpoints Enables... CVE-2026-41056 WWBN AVideo has CORS Origin Reflection with Credentials on Sensitive API Endpoints Enables Cross-Origin Account Takeover: The... https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-34733/ AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard | GitLab... CVE-2026-34733 AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard: The AVideo installation script... https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2024-34899/ AVideo cross-site scripting vulnerability in the view/about.php page | GitLab Advisory Database... CVE-2024-34899 AVideo cross-site scripting vulnerability in the view/about.php page: The PHP file view/about.php is vulnerable to an XSS issue due to no... https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-33502/ AVideo has Unauthenticated SSRF via plugin/Live/test.php | GitLab Advisory Database (GLAD) CVE-2026-33502 AVideo has Unauthenticated SSRF via plugin/Live/test.php: An unauthenticated server-side request forgery vulnerability in plugin/Live/test.php... https://advisories.gitlab.com/composer/wwbn/avideo/CVE-2026-33723/ AVideo is Vulnerable to SQL Injection through Subscribe Endpoint via Unsanitized user_id Parameter... CVE-2026-33723 AVideo is Vulnerable to SQL Injection through Subscribe Endpoint via Unsanitized user_id Parameter: The Subscribe::save() method in... https://advisories.gitlab.com/composer/wwbn/avideo/GHSA-6rc6-p838-686f/ WWBN AVideo has a Path Traversal in Locale Save Endpoint Enables Arbitrary PHP File Write to Any... GHSA-6rc6-p838-686f WWBN AVideo has a Path Traversal in Locale Save Endpoint Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE): The locale...