Packagist / PACKAGE INTELLIGENCE

wwbn/avideo

Get the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.

Check the version you ship.

Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.

Advisories & recorded fixes

medium5.4

GHSA-7cqp-7cfv-6c3q

AVideo Meet plugin: anonymous-to-admin stored XSS via unescaped participant User-Agent in getMeetInfo.json.php Participants panel

Packagist / wwbn/avideo

23 Jun

wwbn/avideo Packagist

Ecosystem versions

Earlier releases through 29.0 (inclusive)

No fix recorded for this interval.

18 explicitly affected versions

10.4, 10.8, 11, 11.1, 11.1.1, 11.5, 11.6, 12.4, 14.3, 14.3.1, 14.4, 18.0, 21.0, 22.0, 24.0, 25.0, 26.0, 29.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "last_affected": "29.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "10.4",
    "10.8",
    "11",
    "11.1",
    "11.1.1",
    "11.5",
    "11.6",
    "12.4",
    "14.3",
    "14.3.1",
    "14.4",
    "18.0",
    "21.0",
    "22.0",
    "24.0",
    "25.0",
    "26.0",
    "29.0"
  ]
}

high7.5

GHSA-wf69-r4mx-43rrFix available

AVideo Vulnerable to Unauthenticated .env File Exposure via Official Docker Compose Configuration

Packagist / wwbn/avideo

22 Jun

wwbn/avideo Packagist

Ecosystem versions

Earlier releases before 29.0

Fixed in 29.0

17 explicitly affected versions

10.4, 10.8, 11, 11.1, 11.1.1, 11.5, 11.6, 12.4, 14.3, 14.3.1, 14.4, 18.0, 21.0, 22.0, 24.0, 25.0, 26.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "29.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "10.4",
    "10.8",
    "11",
    "11.1",
    "11.1.1",
    "11.5",
    "11.6",
    "12.4",
    "14.3",
    "14.3.1",
    "14.4",
    "18.0",
    "21.0",
    "22.0",
    "24.0",
    "25.0",
    "26.0"
  ]
}

medium5.3

GHSA-8j8m-p79x-g4jmFix available

AVideo's Privilege Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet Permissions

Packagist / wwbn/avideo

22 Jun

wwbn/avideo Packagist

Ecosystem versions

Earlier releases before 29.0

Fixed in 29.0

17 explicitly affected versions

10.4, 10.8, 11, 11.1, 11.1.1, 11.5, 11.6, 12.4, 14.3, 14.3.1, 14.4, 18.0, 21.0, 22.0, 24.0, 25.0, 26.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "29.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "10.4",
    "10.8",
    "11",
    "11.1",
    "11.1.1",
    "11.5",
    "11.6",
    "12.4",
    "14.3",
    "14.3.1",
    "14.4",
    "18.0",
    "21.0",
    "22.0",
    "24.0",
    "25.0",
    "26.0"
  ]
}

high7.7

GHSA-2fhx-q92v-5fhv

WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass)

Packagist / wwbn/avideo

04 Jun

wwbn/avideo Packagist

Ecosystem versions

Earlier releases through 29.0 (inclusive)

No fix recorded for this interval.

18 explicitly affected versions

10.4, 10.8, 11, 11.1, 11.1.1, 11.5, 11.6, 12.4, 14.3, 14.3.1, 14.4, 18.0, 21.0, 22.0, 24.0, 25.0, 26.0, 29.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "last_affected": "29.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "10.4",
    "10.8",
    "11",
    "11.1",
    "11.1.1",
    "11.5",
    "11.6",
    "12.4",
    "14.3",
    "14.3.1",
    "14.4",
    "18.0",
    "21.0",
    "22.0",
    "24.0",
    "25.0",
    "26.0",
    "29.0"
  ]
}

high7.7

GHSA-xr49-f4rh-qcjf

AVideo Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization

Packagist / wwbn/avideo

05 May

wwbn/avideo Packagist

Ecosystem versions

Earlier releases through 29.0 (inclusive)

No fix recorded for this interval.

18 explicitly affected versions

10.4, 10.8, 11, 11.1, 11.1.1, 11.5, 11.6, 12.4, 14.3, 14.3.1, 14.4, 18.0, 21.0, 22.0, 24.0, 25.0, 26.0, 29.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "last_affected": "29.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "10.4",
    "10.8",
    "11",
    "11.1",
    "11.1.1",
    "11.5",
    "11.6",
    "12.4",
    "14.3",
    "14.3.1",
    "14.4",
    "18.0",
    "21.0",
    "22.0",
    "24.0",
    "25.0",
    "26.0",
    "29.0"
  ]
}

high7.7

GHSA-2hch-c97c-g99x

AVideo has SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL()

Packagist / wwbn/avideo

05 May

wwbn/avideo Packagist

Ecosystem versions

Earlier releases through 29.0 (inclusive)

No fix recorded for this interval.

18 explicitly affected versions

10.4, 10.8, 11, 11.1, 11.1.1, 11.5, 11.6, 12.4, 14.3, 14.3.1, 14.4, 18.0, 21.0, 22.0, 24.0, 25.0, 26.0, 29.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "last_affected": "29.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "10.4",
    "10.8",
    "11",
    "11.1",
    "11.1.1",
    "11.5",
    "11.6",
    "12.4",
    "14.3",
    "14.3.1",
    "14.4",
    "18.0",
    "21.0",
    "22.0",
    "24.0",
    "25.0",
    "26.0",
    "29.0"
  ]
}

medium5.3

GHSA-6rvw-7p8v-mjfq

AVideo: Unauthenticated User Enumeration in objects/users.json.php via isCompany Parameter Allows Bypass of the Admin-Only Listing Restriction

Packagist / wwbn/avideo

05 May

wwbn/avideo Packagist

Ecosystem versions

Earlier releases through 29.0 (inclusive)

No fix recorded for this interval.

18 explicitly affected versions

10.4, 10.8, 11, 11.1, 11.1.1, 11.5, 11.6, 12.4, 14.3, 14.3.1, 14.4, 18.0, 21.0, 22.0, 24.0, 25.0, 26.0, 29.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "last_affected": "29.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "10.4",
    "10.8",
    "11",
    "11.1",
    "11.1.1",
    "11.5",
    "11.6",
    "12.4",
    "14.3",
    "14.3.1",
    "14.4",
    "18.0",
    "21.0",
    "22.0",
    "24.0",
    "25.0",
    "26.0",
    "29.0"
  ]
}

medium5.3

GHSA-5hgj-7gm9-cff5

AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Enables Phishing from the Site’s Legitimate From Address

Packagist / wwbn/avideo

05 May

wwbn/avideo Packagist

Ecosystem versions

Earlier releases through 29.0 (inclusive)

No fix recorded for this interval.

18 explicitly affected versions

10.4, 10.8, 11, 11.1, 11.1.1, 11.5, 11.6, 12.4, 14.3, 14.3.1, 14.4, 18.0, 21.0, 22.0, 24.0, 25.0, 26.0, 29.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "last_affected": "29.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "10.4",
    "10.8",
    "11",
    "11.1",
    "11.1.1",
    "11.5",
    "11.6",
    "12.4",
    "14.3",
    "14.3.1",
    "14.4",
    "18.0",
    "21.0",
    "22.0",
    "24.0",
    "25.0",
    "26.0",
    "29.0"
  ]
}

medium5.4

GHSA-wp38-whx3-xffh

AVideo has Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT_FOLLOWLOCATION Redirect Bypass

Packagist / wwbn/avideo

05 May

wwbn/avideo Packagist

Ecosystem versions

Earlier releases through 29.0 (inclusive)

No fix recorded for this interval.

18 explicitly affected versions

10.4, 10.8, 11, 11.1, 11.1.1, 11.5, 11.6, 12.4, 14.3, 14.3.1, 14.4, 18.0, 21.0, 22.0, 24.0, 25.0, 26.0, 29.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "last_affected": "29.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "10.4",
    "10.8",
    "11",
    "11.1",
    "11.1.1",
    "11.5",
    "11.6",
    "12.4",
    "14.3",
    "14.3.1",
    "14.4",
    "18.0",
    "21.0",
    "22.0",
    "24.0",
    "25.0",
    "26.0",
    "29.0"
  ]
}

medium6.1

GHSA-mm5f-8q57-4fc4

Video: Reflected XSS in plugin/Meet/iframe.php via Unescaped user and pass Parameters in JavaScript String Literal

Packagist / wwbn/avideo

05 May

wwbn/avideo Packagist

Ecosystem versions

Earlier releases through 29.0 (inclusive)

No fix recorded for this interval.

18 explicitly affected versions

10.4, 10.8, 11, 11.1, 11.1.1, 11.5, 11.6, 12.4, 14.3, 14.3.1, 14.4, 18.0, 21.0, 22.0, 24.0, 25.0, 26.0, 29.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "last_affected": "29.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "10.4",
    "10.8",
    "11",
    "11.1",
    "11.1.1",
    "11.5",
    "11.6",
    "12.4",
    "14.3",
    "14.3.1",
    "14.4",
    "18.0",
    "21.0",
    "22.0",
    "24.0",
    "25.0",
    "26.0",
    "29.0"
  ]
}

medium6.4

GHSA-g9cm-rxp7-6gv5

AVideo: HTML Injection in notifySubscribers.json.php Allows Platform-Branded Phishing Emails to Channel Subscribers

Packagist / wwbn/avideo

05 May

wwbn/avideo Packagist

Ecosystem versions

Earlier releases through 29.0 (inclusive)

No fix recorded for this interval.

18 explicitly affected versions

10.4, 10.8, 11, 11.1, 11.1.1, 11.5, 11.6, 12.4, 14.3, 14.3.1, 14.4, 18.0, 21.0, 22.0, 24.0, 25.0, 26.0, 29.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "last_affected": "29.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "10.4",
    "10.8",
    "11",
    "11.1",
    "11.1.1",
    "11.5",
    "11.6",
    "12.4",
    "14.3",
    "14.3.1",
    "14.4",
    "18.0",
    "21.0",
    "22.0",
    "24.0",
    "25.0",
    "26.0",
    "29.0"
  ]
}

high7.2

GHSA-ghcv-22jf-vfxm

AVideo has an Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']` Relay Bypass

Packagist / wwbn/avideo

05 May

wwbn/avideo Packagist

Ecosystem versions

Earlier releases through 29.0 (inclusive)

No fix recorded for this interval.

18 explicitly affected versions

10.4, 10.8, 11, 11.1, 11.1.1, 11.5, 11.6, 12.4, 14.3, 14.3.1, 14.4, 18.0, 21.0, 22.0, 24.0, 25.0, 26.0, 29.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "last_affected": "29.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "10.4",
    "10.8",
    "11",
    "11.1",
    "11.1.1",
    "11.5",
    "11.6",
    "12.4",
    "14.3",
    "14.3.1",
    "14.4",
    "18.0",
    "21.0",
    "22.0",
    "24.0",
    "25.0",
    "26.0",
    "29.0"
  ]
}

high7.5

GHSA-qm9p-p5pw-jrx2

AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone Server

Packagist / wwbn/avideo

05 May

wwbn/avideo Packagist

Ecosystem versions

Earlier releases through 29.0 (inclusive)

No fix recorded for this interval.

18 explicitly affected versions

10.4, 10.8, 11, 11.1, 11.1.1, 11.5, 11.6, 12.4, 14.3, 14.3.1, 14.4, 18.0, 21.0, 22.0, 24.0, 25.0, 26.0, 29.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "last_affected": "29.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "10.4",
    "10.8",
    "11",
    "11.1",
    "11.1.1",
    "11.5",
    "11.6",
    "12.4",
    "14.3",
    "14.3.1",
    "14.4",
    "18.0",
    "21.0",
    "22.0",
    "24.0",
    "25.0",
    "26.0",
    "29.0"
  ]
}

critical9.8

GHSA-xr6f-h4x7-r6qp

WWBN AVideo: RCE cause by clonesite plugin

Packagist / wwbn/avideo

16 Apr

wwbn/avideo Packagist

Ecosystem versions

Earlier releases through 29.0 (inclusive)

No fix recorded for this interval.

18 explicitly affected versions

10.4, 10.8, 11, 11.1, 11.1.1, 11.5, 11.6, 12.4, 14.3, 14.3.1, 14.4, 18.0, 21.0, 22.0, 24.0, 25.0, 26.0, 29.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "last_affected": "29.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "10.4",
    "10.8",
    "11",
    "11.1",
    "11.1.1",
    "11.5",
    "11.6",
    "12.4",
    "14.3",
    "14.3.1",
    "14.4",
    "18.0",
    "21.0",
    "22.0",
    "24.0",
    "25.0",
    "26.0",
    "29.0"
  ]
}

medium5.4

GHSA-8pv3-29pp-pf8f

WWBN AVideo has Stored XSS via Unanchored Duration Regex in Video Encoder Receiver

Packagist / wwbn/avideo

14 Apr

wwbn/avideo Packagist

Ecosystem versions

Earlier releases through 29.0 (inclusive)

No fix recorded for this interval.

18 explicitly affected versions

10.4, 10.8, 11, 11.1, 11.1.1, 11.5, 11.6, 12.4, 14.3, 14.3.1, 14.4, 18.0, 21.0, 22.0, 24.0, 25.0, 26.0, 29.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "last_affected": "29.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "10.4",
    "10.8",
    "11",
    "11.1",
    "11.1.1",
    "11.5",
    "11.6",
    "12.4",
    "14.3",
    "14.3.1",
    "14.4",
    "18.0",
    "21.0",
    "22.0",
    "24.0",
    "25.0",
    "26.0",
    "29.0"
  ]
}

high7.7

GHSA-j432-4w3j-3w8j

WWBN AVideo has a SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL

Packagist / wwbn/avideo

14 Apr

wwbn/avideo Packagist

Ecosystem versions

Earlier releases through 29.0 (inclusive)

No fix recorded for this interval.

18 explicitly affected versions

10.4, 10.8, 11, 11.1, 11.1.1, 11.5, 11.6, 12.4, 14.3, 14.3.1, 14.4, 18.0, 21.0, 22.0, 24.0, 25.0, 26.0, 29.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "last_affected": "29.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "10.4",
    "10.8",
    "11",
    "11.1",
    "11.1.1",
    "11.5",
    "11.6",
    "12.4",
    "14.3",
    "14.3.1",
    "14.4",
    "18.0",
    "21.0",
    "22.0",
    "24.0",
    "25.0",
    "26.0",
    "29.0"
  ]
}

high8.1

GHSA-5879-4fmr-xwf2

WWBN AVideo has an incomplete fix for CVE-2026-33293: Path Traversal

Packagist / wwbn/avideo

14 Apr

wwbn/avideo Packagist

Ecosystem versions

Earlier releases through 29.0 (inclusive)

No fix recorded for this interval.

18 explicitly affected versions

10.4, 10.8, 11, 11.1, 11.1.1, 11.5, 11.6, 12.4, 14.3, 14.3.1, 14.4, 18.0, 21.0, 22.0, 24.0, 25.0, 26.0, 29.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "last_affected": "29.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "10.4",
    "10.8",
    "11",
    "11.1",
    "11.1.1",
    "11.5",
    "11.6",
    "12.4",
    "14.3",
    "14.3.1",
    "14.4",
    "18.0",
    "21.0",
    "22.0",
    "24.0",
    "25.0",
    "26.0",
    "29.0"
  ]
}

high7.1

GHSA-ff5q-cc22-fgp4

WWBN AVideo has a CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) Exposes Authenticated API Responses

Packagist / wwbn/avideo

14 Apr

wwbn/avideo Packagist

Ecosystem versions

Earlier releases through 29.0 (inclusive)

No fix recorded for this interval.

18 explicitly affected versions

10.4, 10.8, 11, 11.1, 11.1.1, 11.5, 11.6, 12.4, 14.3, 14.3.1, 14.4, 18.0, 21.0, 22.0, 24.0, 25.0, 26.0, 29.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "last_affected": "29.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "10.4",
    "10.8",
    "11",
    "11.1",
    "11.1.1",
    "11.5",
    "11.6",
    "12.4",
    "14.3",
    "14.3.1",
    "14.4",
    "18.0",
    "21.0",
    "22.0",
    "24.0",
    "25.0",
    "26.0",
    "29.0"
  ]
}

medium5.3

GHSA-hg7g-56h5-5pqr

CAPTCHA Bypass in WWBN/AVideo via Attacker-Controlled Length Parameter and Missing Token Invalidation on Failure

Packagist / wwbn/avideo

14 Apr

wwbn/avideo Packagist

Ecosystem versions

Earlier releases through 29.0 (inclusive)

No fix recorded for this interval.

18 explicitly affected versions

10.4, 10.8, 11, 11.1, 11.1.1, 11.5, 11.6, 12.4, 14.3, 14.3.1, 14.4, 18.0, 21.0, 22.0, 24.0, 25.0, 26.0, 29.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "last_affected": "29.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "10.4",
    "10.8",
    "11",
    "11.1",
    "11.1.1",
    "11.5",
    "11.6",
    "12.4",
    "14.3",
    "14.3.1",
    "14.4",
    "18.0",
    "21.0",
    "22.0",
    "24.0",
    "25.0",
    "26.0",
    "29.0"
  ]
}

medium5.4

GHSA-x2pw-9c38-cp2j

WWBN AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset Deletion

Packagist / wwbn/avideo

14 Apr

wwbn/avideo Packagist

Ecosystem versions

Earlier releases through 29.0 (inclusive)

No fix recorded for this interval.

18 explicitly affected versions

10.4, 10.8, 11, 11.1, 11.1.1, 11.5, 11.6, 12.4, 14.3, 14.3.1, 14.4, 18.0, 21.0, 22.0, 24.0, 25.0, 26.0, 29.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "last_affected": "29.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "10.4",
    "10.8",
    "11",
    "11.1",
    "11.1.1",
    "11.5",
    "11.6",
    "12.4",
    "14.3",
    "14.3.1",
    "14.4",
    "18.0",
    "21.0",
    "22.0",
    "24.0",
    "25.0",
    "26.0",
    "29.0"
  ]
}

high7.1

GHSA-ffw8-fwxp-h64w

WWBN AVideo has Multiple CSRF Vulnerabilities in Admin JSON Endpoints (Category CRUD, Plugin Update Script)

Packagist / wwbn/avideo

14 Apr

wwbn/avideo Packagist

Ecosystem versions

Earlier releases through 29.0 (inclusive)

No fix recorded for this interval.

18 explicitly affected versions

10.4, 10.8, 11, 11.1, 11.1.1, 11.5, 11.6, 12.4, 14.3, 14.3.1, 14.4, 18.0, 21.0, 22.0, 24.0, 25.0, 26.0, 29.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "last_affected": "29.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "10.4",
    "10.8",
    "11",
    "11.1",
    "11.1.1",
    "11.5",
    "11.6",
    "12.4",
    "14.3",
    "14.3.1",
    "14.4",
    "18.0",
    "21.0",
    "22.0",
    "24.0",
    "25.0",
    "26.0",
    "29.0"
  ]
}

high8.3

GHSA-vvfw-4m39-fjqf

WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials

Packagist / wwbn/avideo

14 Apr

wwbn/avideo Packagist

Ecosystem versions

Earlier releases through 29.0 (inclusive)

No fix recorded for this interval.

18 explicitly affected versions

10.4, 10.8, 11, 11.1, 11.1.1, 11.5, 11.6, 12.4, 14.3, 14.3.1, 14.4, 18.0, 21.0, 22.0, 24.0, 25.0, 26.0, 29.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "last_affected": "29.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "10.4",
    "10.8",
    "11",
    "11.1",
    "11.1.1",
    "11.5",
    "11.6",
    "12.4",
    "14.3",
    "14.3.1",
    "14.4",
    "18.0",
    "21.0",
    "22.0",
    "24.0",
    "25.0",
    "26.0",
    "29.0"
  ]
}

medium5.3

GHSA-52hf-63q4-r926

WWBN AVideo has an Unauthenticated Information Disclosure via git.json.php Exposes Developer Emails and Deployed Version

Packagist / wwbn/avideo

14 Apr

wwbn/avideo Packagist

Ecosystem versions

Earlier releases through 29.0 (inclusive)

No fix recorded for this interval.

18 explicitly affected versions

10.4, 10.8, 11, 11.1, 11.1.1, 11.5, 11.6, 12.4, 14.3, 14.3.1, 14.4, 18.0, 21.0, 22.0, 24.0, 25.0, 26.0, 29.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "last_affected": "29.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "10.4",
    "10.8",
    "11",
    "11.1",
    "11.1.1",
    "11.5",
    "11.6",
    "12.4",
    "14.3",
    "14.3.1",
    "14.4",
    "18.0",
    "21.0",
    "22.0",
    "24.0",
    "25.0",
    "26.0",
    "29.0"
  ]
}

medium5.4

GHSA-rqp3-gf5h-mrqx

WWBN AVideo has Stored XSS via Malicious EPG XML Program Titles in AVideo EPG Page

Packagist / wwbn/avideo

08 Apr

wwbn/avideo Packagist

Ecosystem versions

Earlier releases through 26.0 (inclusive)

No fix recorded for this interval.

17 explicitly affected versions

10.4, 10.8, 11, 11.1, 11.1.1, 11.5, 11.6, 12.4, 14.3, 14.3.1, 14.4, 18.0, 21.0, 22.0, 24.0, 25.0, 26.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "last_affected": "26.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "10.4",
    "10.8",
    "11",
    "11.1",
    "11.1.1",
    "11.5",
    "11.6",
    "12.4",
    "14.3",
    "14.3.1",
    "14.4",
    "18.0",
    "21.0",
    "22.0",
    "24.0",
    "25.0",
    "26.0"
  ]
}

medium6.5

GHSA-mmw7-wq3c-wf9p

WWBN AVideo Affected by a PayPal IPN Replay Attack Enabling Wallet Balance Inflation via Missing Transaction Deduplication in ipn.php

Packagist / wwbn/avideo

08 Apr

wwbn/avideo Packagist

Ecosystem versions

Earlier releases through 26.0 (inclusive)

No fix recorded for this interval.

17 explicitly affected versions

10.4, 10.8, 11, 11.1, 11.1.1, 11.5, 11.6, 12.4, 14.3, 14.3.1, 14.4, 18.0, 21.0, 22.0, 24.0, 25.0, 26.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "last_affected": "26.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "10.4",
    "10.8",
    "11",
    "11.1",
    "11.1.1",
    "11.5",
    "11.6",
    "12.4",
    "14.3",
    "14.3.1",
    "14.4",
    "18.0",
    "21.0",
    "22.0",
    "24.0",
    "25.0",
    "26.0"
  ]
}

medium5.3

GHSA-99j6-hj87-6fcf

AVideo: Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php

Packagist / wwbn/avideo

04 Apr

wwbn/avideo Packagist

Ecosystem versions

Earlier releases through 26.0 (inclusive)

No fix recorded for this interval.

17 explicitly affected versions

10.4, 10.8, 11, 11.1, 11.1.1, 11.5, 11.6, 12.4, 14.3, 14.3.1, 14.4, 18.0, 21.0, 22.0, 24.0, 25.0, 26.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "last_affected": "26.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "10.4",
    "10.8",
    "11",
    "11.1",
    "11.1.1",
    "11.5",
    "11.6",
    "12.4",
    "14.3",
    "14.3.1",
    "14.4",
    "18.0",
    "21.0",
    "22.0",
    "24.0",
    "25.0",
    "26.0"
  ]
}

medium5.3

GHSA-2vg4-rrx4-qcpq

AVideo: Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php

Packagist / wwbn/avideo

04 Apr

wwbn/avideo Packagist

Ecosystem versions

Earlier releases through 26.0 (inclusive)

No fix recorded for this interval.

17 explicitly affected versions

10.4, 10.8, 11, 11.1, 11.1.1, 11.5, 11.6, 12.4, 14.3, 14.3.1, 14.4, 18.0, 21.0, 22.0, 24.0, 25.0, 26.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "last_affected": "26.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "10.4",
    "10.8",
    "11",
    "11.1",
    "11.1.1",
    "11.5",
    "11.6",
    "12.4",
    "14.3",
    "14.3.1",
    "14.4",
    "18.0",
    "21.0",
    "22.0",
    "24.0",
    "25.0",
    "26.0"
  ]
}

medium5.3

GHSA-hg8q-8wqr-35xx

AVideo: Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.php

Packagist / wwbn/avideo

04 Apr

wwbn/avideo Packagist

Ecosystem versions

Earlier releases through 26.0 (inclusive)

No fix recorded for this interval.

17 explicitly affected versions

10.4, 10.8, 11, 11.1, 11.1.1, 11.5, 11.6, 12.4, 14.3, 14.3.1, 14.4, 18.0, 21.0, 22.0, 24.0, 25.0, 26.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "last_affected": "26.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "10.4",
    "10.8",
    "11",
    "11.1",
    "11.1.1",
    "11.5",
    "11.6",
    "12.4",
    "14.3",
    "14.3.1",
    "14.4",
    "18.0",
    "21.0",
    "22.0",
    "24.0",
    "25.0",
    "26.0"
  ]
}

medium4.3

GHSA-4q27-4rrq-fx95

AVideo: CSRF on Player Skin Configuration via admin/playerUpdate.json.php

Packagist / wwbn/avideo

03 Apr

wwbn/avideo Packagist

Ecosystem versions

Earlier releases through 26.0 (inclusive)

No fix recorded for this interval.

17 explicitly affected versions

10.4, 10.8, 11, 11.1, 11.1.1, 11.5, 11.6, 12.4, 14.3, 14.3.1, 14.4, 18.0, 21.0, 22.0, 24.0, 25.0, 26.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "last_affected": "26.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "10.4",
    "10.8",
    "11",
    "11.1",
    "11.1.1",
    "11.5",
    "11.6",
    "12.4",
    "14.3",
    "14.3.1",
    "14.4",
    "18.0",
    "21.0",
    "22.0",
    "24.0",
    "25.0",
    "26.0"
  ]
}

medium6.1

GHSA-gmpc-fxg2-vcmq

AVideo has Stored XSS via Unescaped Menu Item Fields in TopMenu Plugin

Packagist / wwbn/avideo

01 Apr

wwbn/avideo Packagist

Ecosystem versions

Earlier releases through 26.0 (inclusive)

No fix recorded for this interval.

17 explicitly affected versions

10.4, 10.8, 11, 11.1, 11.1.1, 11.5, 11.6, 12.4, 14.3, 14.3.1, 14.4, 18.0, 21.0, 22.0, 24.0, 25.0, 26.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "last_affected": "26.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "10.4",
    "10.8",
    "11",
    "11.1",
    "11.1.1",
    "11.5",
    "11.6",
    "12.4",
    "14.3",
    "14.3.1",
    "14.4",
    "18.0",
    "21.0",
    "22.0",
    "24.0",
    "25.0",
    "26.0"
  ]
}

More advisories