Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*

4 briefs RSS
high advisory

Stored Cross-Site Scripting in WWBN AVideo via Video Titles

WWBN AVideo versions 12.4 through 29.2.0 are vulnerable to stored cross-site scripting (XSS) due to improper sanitization of doubly-encoded HTML entities in video titles, allowing authenticated attackers to execute arbitrary scripts in the context of gallery and playlist pages.

AVideo
1t 1c
critical advisory

WWBN AVideo SSRF Filter Bypass via NAT64 Hex Encoding

WWBN AVideo is vulnerable to a Server-Side Request Forgery (SSRF) bypass in the isSSRFSafeURL function due to improper normalization of hex-encoded NAT64 addresses.

AVideo +7 credential-access web-application authentication-bypass web-application-vulnerability path-traversal reconnaissance web-vulnerability csrf +13
7r 15t 1c updated
medium advisory

Unauthorized Memcached Data Manipulation via CVE-2026-29093

Unauthorized actors can leverage the lack of native authentication in Memcached to perform data manipulation or session hijacking, as identified in CVE-2026-29093.

Memcached network-security cve-2026-29093 impact
1r 1t 1c
high advisory

AVideo OS Command Injection via Unescaped m3u8 URL (CVE-2026-45578)

AVideo is vulnerable to OS command injection (CVE-2026-45578) in the `on_publish.php` file due to improper sanitization of the m3u8 URL, allowing attackers to execute arbitrary commands by injecting shell metacharacters.

AVideo +1 command injection webserver
2r 1t 2c 3i updated