Security
English
همهٔ محصولات

wwbn/avideo

Composer · بسته
160 گزارش
اطلاع‌رسانی آسیب‌پذیری
دنبال‌کردن
گزارشمحصولاکوسیستمشدتوضعیت اصلاحآخرین تغییر
WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket PluginCVE-2026-54458 · GHSA-8WHC-2WMV-WW35 wwbn/avideo Composer بحرانی اصلاح گزارش شده
AVideo has Unauthenticated PGP Message Decryption via Public EndpointCVE-2026-56346 · GHSA-5X2W-37XF-7962 wwbn/avideo Composer متوسط اصلاح اعلام نشده
AVideo Vulnerable to Unauthenticated .env File Exposure via Official Docker Compose ConfigurationCVE-2026-33692 · GHSA-WF69-R4MX-43RR wwbn/avideo Composer زیاد اصلاح گزارش شده
AVideo's Privilege Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet PermissionsCVE-2026-33684 · GHSA-8J8M-P79X-G4JM wwbn/avideo Composer متوسط اصلاح گزارش شده
WWBN AVideo: Stored XSS via unescaped Gallery category descriptionCVE-2026-47694 · GHSA-C8H8-VQ34-9FW2 wwbn/avideo Composer متوسط اصلاح اعلام نشده
AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php`CVE-2026-46337 · GHSA-W4QQ-74H6-58WQ wwbn/avideo Composer متوسط اصلاح اعلام نشده
AVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumeration sibling that survives `d9cdc7024`CVE-2026-45620 · GHSA-VPFX-PXQW-2W79 wwbn/avideo Composer متوسط اصلاح اعلام نشده
AVideo: OS command injection in on_publish.php execAsync via unescaped m3u8 URLCVE-2026-45578 · GHSA-XW67-CG5F-4M2R wwbn/avideo Composer زیاد اصلاح اعلام نشده
WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass)CVE-2026-49279 · GHSA-2FHX-Q92V-5FHV wwbn/avideo Composer زیاد اصلاح اعلام نشده
AVideo: stored XSS via unescaped stream key in modeYoutubeLive.php class attributeCVE-2026-45580 · GHSA-M5J4-7R85-2CJ2 wwbn/avideo Composer متوسط اصلاح اعلام نشده
AVideo: Authenticated Arbitrary File Read in view/update.phpCVE-2026-45731 · GHSA-3MJV-375J-6H92 wwbn/avideo Composer متوسط اصلاح اعلام نشده
WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal servicesCVE-2026-39368 · GHSA-Q4X6-6MM2-CRG9 wwbn/avideo Composer متوسط اصلاح اعلام نشده
AVideo's Meet plugin: `uploadRecordedVideo.json.php` derives `users_id` from the uploaded filename and calls passwordless `User->login()`, allowing any caller with the Meet shared secret to obtain a session as arbitrary users including adminCVE-2026-56345 · GHSA-QXVM-R42F-5P8J wwbn/avideo Composer زیاد اصلاح اعلام نشده
AVideo has an incomplete fix of CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command execution at the same execAsync sh -c sinkCVE-2026-55173 · GHSA-WC3F-XC32-435F wwbn/avideo Composer زیاد اصلاح اعلام نشده
AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment DataCVE-2026-33731 · GHSA-95JH-7R58-XMXW wwbn/avideo Composer متوسط اصلاح گزارش شده
WWBN AVideo: Unauthenticated Reflected XSS via $_GET['search'] in AVideo YouTubeAPI Gallery PaginationCVE-2026-50182 · GHSA-HGJH-6WJ8-GCGF wwbn/avideo Composer متوسط اصلاح اعلام نشده
WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpointCVE-2026-47696 · GHSA-9392-PJ54-QQF8 wwbn/avideo Composer زیاد اصلاح اعلام نشده
AVideo Meet plugin: anonymous-to-admin stored XSS via unescaped participant User-Agent in getMeetInfo.json.php Participants panelCVE-2026-60092 · GHSA-7CQP-7CFV-6C3Q wwbn/avideo Composer متوسط اصلاح اعلام نشده
WWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery SectionCVE-2026-50183 · GHSA-66Q5-CJ5G-WRFX wwbn/avideo Composer متوسط اصلاح اعلام نشده
AVideo CVE-2026-43884 incomplete fix - six (or more) `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD post-`603e7bf`CVE-2026-45619 · GHSA-C3CH-22RQ-XFWR wwbn/avideo Composer متوسط اصلاح اعلام نشده