Product

AVideo (<= C3edcc274c389816d434acadac07ee78eaf330c1)

3 briefs RSS

Cross-Site Scripting Vulnerability in AVideo YPTSocket Plugin

An unauthenticated XSS vulnerability in the AVideo YPTSocket plugin allows attackers to execute arbitrary JavaScript in victim browsers via crafted websocket callback messages.

AVideo +3 web-application xss injection web-security access-control pii-leak account-takeover authentication-bypass +1

9t 1c updated Sep 17, 2026

critical advisory

WWBN AVideo SSRF Filter Bypass via NAT64 Hex Encoding

7 rules 15 TTPs 1 CVE

WWBN AVideo is vulnerable to a Server-Side Request Forgery (SSRF) bypass in the isSSRFSafeURL function due to improper normalization of hex-encoded NAT64 addresses.

AVideo +7 credential-access web-application authentication-bypass web-application-vulnerability path-traversal reconnaissance web-vulnerability csrf +13

7r 15t 1c updated Sep 17, 2026

high advisory

Authentication Bypass in AVideo via Parameter Manipulation

7 rules 13 TTPs 1 CVE

An authentication bypass vulnerability in AVideo (CVE-2026-59808) allows attackers with upload access to hijack administrative sessions via improper video ownership verification.

AVideo +6 authentication-bypass privilege-escalation web-application ssrf vulnerability credential-theft web-vulnerability path-traversal +4

7r 13t 1c updated Sep 8, 2026