CVE-2026-88876AVideo PlayerSkins seo.php Missing Authorization Password-Protected VOD Exploitation status Not confirmed Fix Published 09/10/2026 Severity High CVE-2026-88875AVideo Incomplete API Sanitization Information Disclosure Exploitation status Not confirmed Fix Published 09/10/2026 Severity Medium CVE-2026-88874AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 Authentication Bypass Exploitation status Public exploit Fix Published 09/10/2026 Severity High CVE-2026-88873WWBN AVideo Cross-Site Request Forgery via logArchive.json.php Exploitation status Not known exploited Fix Published 09/10/2026 Severity High CVE-2026-88872AVideo CustomizeUser setPassword.json.php CSRF Exploitation status Public exploit Fix Published 09/10/2026 Severity High CVE-2026-88871WWBN AVideo CustomizeUser setSubscribers CSRF via GET Exploitation status Not confirmed Fix Published 09/10/2026 Severity Medium CVE-2026-88870WWBN AVideo LoginControl PGP Key CSRF via GET Request Exploitation status Not confirmed Fix Published 09/10/2026 Severity High CVE-2026-88869AVideo AD_Server Stored XSS via log.php label parameter Exploitation status Public exploit Fix Published 09/10/2026 Severity Critical CVE-2026-88868AVideo LiveLinks Stored XSS via title and description fields Exploitation status Not known exploited Fix Published 09/10/2026 Severity Critical CVE-2026-88867WWBN AVideo Stored XSS via Category Name and Icon Class Exploitation status Public exploit Fix Published 09/10/2026 Severity Critical CVE-2026-88866WWBN AVideo LoginControl Stored XSS via User-Agent Header Exploitation status Not confirmed Fix Published 09/10/2026 Severity Critical CVE-2026-88865AVideo Missing Authorization via getRestream.json.php Exploitation status Not confirmed Fix Published 09/10/2026 Severity High CVE-2026-86729WWBN AVideo Unrestricted Authentication Attempts via get_api_preauthorize Exploitation status Not known exploited Fix Published 09/08/2026 Severity Critical CVE-2026-86728AVideo through 29.0 Unauthenticated Disclosure via epg.json.php Exploitation status Not known exploited Fix Published 09/08/2026 Severity High CVE-2026-86727AVideo through 29.0 Information Disclosure via stats.json.php Exploitation status Public exploit Fix Published 09/08/2026 Severity High CVE-2026-86726AVideo through 29.0 Information Disclosure via restreamsActive.json.php Exploitation status Not confirmed Fix Published 09/08/2026 Severity High CVE-2026-86725AVideo SocialMediaPublisher Missing Authorization via add.json.php Exploitation status Public exploit Fix Published 09/08/2026 Severity High CVE-2026-86724AVideo YPTWallet saveBalance.php Cross-Site Request Forgery Exploitation status Not known exploited Fix Published 09/08/2026 Severity High CVE-2026-86723AVideo LoginControl PGP Authentication Bypass via verifyChallenge Exploitation status Not known exploited Fix Published 09/08/2026 Severity High CVE-2026-86722AVideo Authentication Bypass via SQL Cache Invalidation Exploitation status Public exploit Fix Published 09/08/2026 Severity High CVE-2026-86721AVideo through c3edcc274c Authorization Bypass via Session Cookie Exploitation status Not confirmed Fix Published 09/08/2026 Severity High CVE-2026-86720WWBN AVideo Missing Authorization via resendRestreamer.json.php Exploitation status Public exploit Fix Published 09/08/2026 Severity High CVE-2026-86719WWBN AVideo CustomizeUser Cross-Site Request Forgery Session Hijacking Exploitation status Not known exploited Fix Published 09/08/2026 Severity Medium CVE-2026-86718WWBN AVideo Cross-Site Request Forgery via deleteHistory.json.php Exploitation status Public exploit Fix Published 09/08/2026 Severity High CVE-2026-86190WWBN AVideo Broken Access Control via videoViewsInfo hash Parameter Exploitation status Public exploit Fix Published 09/05/2026 Severity Critical CVE-2026-86189WWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg.json.php Exploitation status Not confirmed Fix Published 09/05/2026 Severity Critical CVE-2026-86188AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting Exploitation status Public exploit Fix Published 09/05/2026 Severity Medium CVE-2026-86187WWBN AVideo Weak PRNG Password Generation via External Login Exploitation status Not known exploited Fix Published 09/05/2026 Severity High CVE-2026-86186AVideo API Rate Limit Bypass via Bot User-Agent Header Exploitation status Public exploit Fix Published 09/05/2026 Severity Medium CVE-2026-85577AVideo userLogin.php Reflected XSS via error parameter Exploitation status Public exploit Fix Published 09/04/2026 Severity Medium CVE-2026-85164WWBN AVideo Server-Side Request Forgery via set_api_userImages Exploitation status Public exploit Fix Published 09/03/2026 Severity High CVE-2026-85163AVideo Server-Side Request Forgery via epg_link parameter Exploitation status Public exploit Fix Published 09/03/2026 Severity High CVE-2026-85162AVideo through c91b5975d CSRF via saveLive.php Exploitation status Public exploit Fix Published 09/03/2026 Severity High CVE-2026-85161AVideo removePoster.php Cross-Site Request Forgery File Deletion Exploitation status Not known exploited Fix Published 09/03/2026 Severity Medium CVE-2026-85160AVideo through c91b5975d CSRF and Path Traversal via stopLive.php Exploitation status Public exploit Fix Published 09/03/2026 Severity High CVE-2026-85159AVideo Reflected XSS via cancelUri in userLogin.php Exploitation status Public exploit Fix Published 09/03/2026 Severity Medium CVE-2026-85158AVideo Reflected XSS via videoEmbeded.php link parameter Exploitation status Public exploit Fix Published 09/03/2026 Severity Medium CVE-2026-85157WWBN AVideo Broken Access Control via feed/index.php program_id Exploitation status Public exploit Fix Published 09/03/2026 Severity Medium CVE-2026-85156WWBN AVideo Broken Access Control via Channel Page Exploitation status Not known exploited Fix Published 09/03/2026 Severity Medium CVE-2026-85155WWBN AVideo SQL Injection via get.json.php APIName channels Exploitation status Public exploit Fix Published 09/03/2026 Severity High CVE-2026-85154WWBN AVideo Authentication Bypass via Non-Expiring video_id_hash Exploitation status Public exploit Fix Published 09/03/2026 Severity Critical CVE-2026-84483WWBN AVideo Unauthenticated Password Hash Oracle via encryptPass.json.php Exploitation status Public exploit Fix Published 09/01/2026 Severity Medium CVE-2026-84482WWBN AVideo Cross-Site Request Forgery via get_domain() validation Exploitation status Public exploit Fix Published 09/01/2026 Severity High CVE-2026-84481WWBN AVideo through 30.0 Information Disclosure via MobileManager Exploitation status Public exploit Fix Published 09/01/2026 Severity Medium CVE-2026-84480WWBN AVideo Password Recovery Token Expiration Bypass Exploitation status Not known exploited Fix Published 09/01/2026 Severity Critical CVE-2026-84479WWBN AVideo Authentication Bypass via User-Agent Header Exploitation status Public exploit Fix Published 09/01/2026 Severity Critical CVE-2026-84478WWBN AVideo Unauthenticated Arbitrary Log File Deletion Exploitation status Public exploit Fix Published 09/01/2026 Severity Medium CVE-2026-84477AVideo Stored XSS via Live Schedule Title Description Exploitation status Public exploit Fix Published 09/01/2026 Severity Medium CVE-2026-84476WWBN AVideo Authentication Bypass via X-Real-IP Header Exploitation status Public exploit Fix Published 09/01/2026 Severity High CVE-2026-84208AVideo User_Location Plugin Unauthenticated SQL Injection Exploitation status Not known exploited Fix Published 09/01/2026 Severity High CVE-2026-84187AVideo on_publish.php Missing Authentication Check via RTMP Callback Exploitation status Public exploit Fix Published 09/01/2026 Severity High CVE-2026-83595AVideo Cross-Site Request Forgery via plugin/API/set.json.php Exploitation status Not known exploited Fix Published 09/01/2026 Severity High CVE-2026-82648WWBN AVideo SSRF Filter Bypass via NAT64 Hex Address Exploitation status Public exploit Fix Not confirmed Published 08/30/2026 Severity High CVE-2026-82647WWBN AVideo Cross-Site Request Forgery via sendEmail.json.php Exploitation status Public exploit Fix Not confirmed Published 08/30/2026 Severity Medium CVE-2026-82646WWBN AVideo Unauthenticated Reflected XSS via url2Embed.json.php Exploitation status Not known exploited Fix Not confirmed Published 08/30/2026 Severity Medium CVE-2026-82645AVideo Unauthenticated Stream Credential Disclosure via Forgeable Token Exploitation status Public exploit Fix Not confirmed Published 08/30/2026 Severity Critical CVE-2026-82644WWBN AVideo Brute-force Rate Limiting Bypass via Missing User-Agent Exploitation status Public exploit Fix Not confirmed Published 08/30/2026 Severity High CVE-2026-82643WWBN AVideo Unauthenticated Rate Limit Bypass via preauthorize.json.php Exploitation status Public exploit Fix Not confirmed Published 08/30/2026 Severity Medium CVE-2026-81733WWBN AVideo through 30.0 CSRF via myLiveControls.save.json.php Exploitation status Public exploit Fix Published 08/28/2026 Severity Medium CVE-2026-81732WWBN AVideo through 30.0 Information Disclosure via report4.json.php Exploitation status Public exploit Fix Published 08/28/2026 Severity Medium CVE-2026-81678AVideo SSRF Guard Bypass via IPv6 Transition Addresses Exploitation status Public exploit Fix Published 08/27/2026 Severity Medium CVE-2026-59808AVideo Authentication Bypass via Unkeyed Video Hash Disclosure Exploitation status Public exploit Fix Published 08/22/2026 Severity High CVE-2026-59256WWBN AVideo Unbound Token Authorization Bypass via Gallery Exploitation status Public exploit Fix Published 08/22/2026 Severity High CVE-2026-58003WWBN AVideo Cross-Site Request Forgery via releaseVideoNow.json.php Exploitation status Public exploit Fix Published 08/22/2026 Severity High CVE-2026-58002WWBN AVideo Authorization Bypass via Users_affiliations add.json.php Exploitation status Public exploit Fix Published 08/22/2026 Severity High CVE-2026-58001WWBN AVideo Cross-Site Request Forgery via videoEditLight.php Exploitation status Not known exploited Fix Published 08/22/2026 Severity Medium CVE-2026-57944AVideo channelToGallery.json.php Cross-Site Request Forgery Exploitation status Public exploit Fix Published 08/22/2026 Severity Medium CVE-2026-56380AVideo feed/index.php Exposure of Channel Owner Email Address Exploitation status Public exploit Fix Published 08/22/2026 Severity Medium CVE-2026-72748AVideo Unauthenticated Arbitrary File Write via aVideoEncoderChunk.json.php Exploitation status Public exploit Fix Published 08/11/2026 Severity Medium CVE-2026-72747AVideo Stored Cross-Site Scripting via Unauthenticated Registration Exploitation status Public exploit Fix Published 08/11/2026 Severity Medium CVE-2026-64626AVideo Encoder downloadURL SSRF via unpinned retry fallback Exploitation status Public exploit Fix Not confirmed Published 07/20/2026 Severity Medium CVE-2026-64625AVideo before 29.0 OS Command Injection via execAsync Exploitation status Not known exploited Fix Published 07/20/2026 Severity Critical CVE-2026-33731AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data Exploitation status Public exploit Fix Published 07/16/2026 Severity Medium CVE-2026-55173AVideo incomplete fix for CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command execution at the same execAsync sh -c sink Exploitation status Public exploit Fix Published 07/16/2026 Severity High CVE-2026-33692AVideo Has Unauthenticated .env File Exposure via Official Docker Compose Configuration Exploitation status Public exploit Fix Published 07/16/2026 Severity High CVE-2026-63305AVideo through 29.0 OS Command Injection via ffmpeg.json.php Exploitation status Public exploit Fix Published 07/16/2026 Severity Critical CVE-2026-63304AVideo through 29.0 OS Command Injection via listFFmpegProcesses Exploitation status Public exploit Fix Published 07/16/2026 Severity Critical CVE-2026-54458AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin Exploitation status Public exploit Fix Published 07/15/2026 Severity Critical CVE-2026-50183WWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery Section Exploitation status Public exploit Fix Not confirmed Published 07/15/2026 Severity Medium CVE-2026-50182AVideo Has Unauthenticated Reflected XSS via $_GET['search'] in YouTubeAPI Gallery Pagination Exploitation status Public exploit Fix Published 07/15/2026 Severity Medium CVE-2026-49279WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass) Exploitation status Public exploit Fix Not confirmed Published 07/15/2026 Severity High CVE-2026-33684AVideo's Privilege AVideo: Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet Permissions Exploitation status Public exploit Fix Published 07/15/2026 Severity Medium CVE-2026-56347AVideo TopMenu Plugin - Stored Cross-Site Scripting via Unescaped Menu Item Fields Exploitation status Public exploit Fix Published 06/20/2026 Severity Medium CVE-2026-45580WWBN AVideo Live: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute Exploitation status Not known exploited Fix Not confirmed Published 05/29/2026 Severity Medium CVE-2026-45578WWBN AVideo Live: OS command injection in on_publish.php execAsync via unescaped m3u8 URL Exploitation status Not known exploited Fix Not confirmed Published 05/29/2026 Severity High CVE-2026-45610WWBN AVideo plugin/LoginControl/set.json.php: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA Exploitation status Public exploit Fix Not confirmed Published 05/29/2026 Severity Medium CVE-2026-45619AVideo CVE-2026-43884 incomplete fix - `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD post Exploitation status Not known exploited Fix Not confirmed Published 05/29/2026 Severity Medium CVE-2026-45620AVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumeration Exploitation status Not known exploited Fix Not confirmed Published 05/29/2026 Severity Medium CVE-2026-45731WWBN AVideo: Authenticated Arbitrary File Read in view/update.php Exploitation status Public exploit Fix Not confirmed Published 05/29/2026 Severity Medium CVE-2026-46337WWBN AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php` Exploitation status Public exploit Fix Not confirmed Published 05/29/2026 Severity Medium CVE-2026-47694WWBN AVideo: Stored XSS via unescaped Gallery category description Exploitation status Public exploit Fix Not confirmed Published 05/29/2026 Severity Medium CVE-2026-47696WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint Exploitation status Public exploit Fix Not confirmed Published 05/29/2026 Severity High CVE-2026-43885WWBN AVideo: Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization Exploitation status Public exploit Fix Not confirmed Published 05/11/2026 Severity High CVE-2026-43884WWBN AVideo: SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL() Exploitation status Not known exploited Fix Not confirmed Published 05/11/2026 Severity High CVE-2026-43883WWBN AVideo: IDOR in PayPalYPT agreementCancel.json.php Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription Agreements Exploitation status Public exploit Fix Not confirmed Published 05/11/2026 Severity Medium CVE-2026-43882WWBN AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event Spoofing Exploitation status Public exploit Fix Not confirmed Published 05/11/2026 Severity Medium CVE-2026-43881WWBN AVideo: Unauthenticated User Enumeration in `objects/users.json.php` via `isCompany` Parameter Flips `$ignoreAdmin = true` and Defeats Admin-Only Listing Guard Exploitation status Public exploit Fix Not confirmed Published 05/11/2026 Severity Medium CVE-2026-43880WWBN AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Allows Phishing from Site's Legitimate From Address Exploitation status Public exploit Fix Not confirmed Published 05/11/2026 Severity Medium CVE-2026-43879WWBN AVideo: Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT_FOLLOWLOCATION Redirect Bypass Exploitation status Public exploit Fix Not confirmed Published 05/11/2026 Severity Medium CVE-2026-43878WWBN AVideo: Reflected XSS in plugin/Meet/iframe.php via Unescaped `user`/`pass` Parameters Reflected into JavaScript String Literal Exploitation status Public exploit Fix Not confirmed Published 05/11/2026 Severity Medium 
