AVideo (14.3 - 29.7.1)

WWBN AVideo versions 14.3 through 29.7.1 contain a stored cross-site scripting vulnerability in objects/aVideoEncoder.json.php that allows authenticated uploaders to execute malicious scripts in administrator sessions to install arbitrary PHP code.