Sitelet https://github.com/WWBN/AVideo/security

Security

Report a vulnerability

.github/SECURITY.md

Security Policy

Reporting a Vulnerability

Please report security issues to developer@streamphp.com

WWBN AVideo through 29.2.0 Stored XSS via Video trailer1 in YouPHPFlix2 Templates
GHSA-6wfr-c7fw-4xvw published Oct 4, 2026 by DanielnetoDotCom

High
WWBN AVideo through 29.2.0 Stored XSS via Double-Encoded Video Title
GHSA-q62w-927x-vhhf published Oct 4, 2026 by DanielnetoDotCom

High
Stored XSS in video trailer1 field via HTML-entity bypass of isValidurl()
GHSA-v7vx-v9q9-qhw3 published Sep 11, 2026 by DanielnetoDotCom

Moderate
Use of a cryptographically weak PRNG: RTMP publish keys are raw `uniqid()` values derived from the transmission creation time
GHSA-h983-2mcw-672j published Sep 2, 2026 by DanielnetoDotCom

Moderate
Use of a cryptographically weak PRNG: `getRandomCode()` activation codes are a pure function of server microtime, and redeeming one returns a one-year authentication token
GHSA-v65f-hc7x-wj62 published Sep 2, 2026 by DanielnetoDotCom

High
Broken Access Control: the clean_title branch of get_api_video returns a user-group-restricted video, with the owner's full PII, to anonymous callers, while the videos_id branch of the same endpoint refuses it
GHSA-w59h-5r8w-686r published Sep 1, 2026 by DanielnetoDotCom

High
Identification and Authentication Failures: LoginControl's PGP second factor is satisfied by a single parameter-less GET, because the challenge is compared with == against a session value that is unset until the challenge page is rendered
GHSA-mvmf-jqg6-qhjf published Sep 2, 2026 by DanielnetoDotCom

High
Identification and Authentication Failures: the stored password hash is accepted as the password by two independent paths, so any disclosure of users.password is a direct login with no cracking
GHSA-fq38-jp6c-q4cx published Sep 1, 2026 by DanielnetoDotCom

Critical
Broken Access Control: autoCSRFGuard()'s exemption allowlist matches on basename only, so plugin files inherit exemptions written for core files; one of them logs any authenticated user out on a cross-site request
GHSA-3hg6-6x7m-5xr8 published Sep 1, 2026 by DanielnetoDotCom

Moderate
CloneSite stored shell injection via an unescaped SSH password, plantable by CSRF and fired unattended by the plugin's own cron (residual sink of CVE-2026-41304)
GHSA-g96r-pgr6-m7hh published Sep 1, 2026 by DanielnetoDotCom

High

Learn more about advisories related to WWBN/AVideo in the GitHub Advisory Database

Security: WWBN/AVideo

Security

.github/SECURITY.md

Security Policy

Reporting a Vulnerability