Wwbn/avideo

This hub aggregates every CVE we track for Wwbn/avideo, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Wwbn/avideo.

• GHSA-7cqp-7cfv-6c3qAVideo Meet plugin: anonymous-to-admin stored XSS via unescaped participant User-Agent in getMeetInfo.json.php Participants panelJun 23, 2026
• GHSA-8whc-2wmv-ww35WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket PluginJun 4, 2026
• GHSA-qxvm-r42f-5p8jAVideo's Meet plugin: `uploadRecordedVideo.json.php` derives `users_id` from the uploaded filename and calls passwordless `User->login()`, allowing any caller with the Meet shared secret to obtain a session as arbitrary users including adminMay 15, 2026
• GHSA-xr6f-h4x7-r6qpWWBN AVideo: RCE cause by clonesite pluginApr 16, 2026
• GHSA-pq8p-wc4f-vg7jWWBN AVideo has an incomplete fix for CVE-2026-33502: Command InjectionApr 14, 2026
• GHSA-m7r8-6q9j-m2hcWWBN AVideo has an incomplete fix for CVE-2026-33500: XSSApr 14, 2026
• GHSA-m63r-m9jh-3vc6WWBN AVideo has an Incomplete fix: Directory traversal bypass via query string in ReceiveImage downloadURL parametersApr 14, 2026
• GHSA-8pv3-29pp-pf8fWWBN AVideo has Stored XSS via Unanchored Duration Regex in Video Encoder ReceiverApr 14, 2026
• GHSA-j432-4w3j-3w8jWWBN AVideo has a SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURLApr 14, 2026
• GHSA-5879-4fmr-xwf2WWBN AVideo has an incomplete fix for CVE-2026-33293: Path TraversalApr 14, 2026
• GHSA-ff5q-cc22-fgp4WWBN AVideo has a CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) Exposes Authenticated API ResponsesApr 14, 2026
• GHSA-ccq9-r5cw-5hwqWWBN AVideo has CORS Origin Reflection with Credentials on Sensitive API Endpoints Enables Cross-Origin Account TakeoverApr 14, 2026
• GHSA-793q-xgj6-7frpWWBN AVideo has an incomplete fix for CVE-2026-33039: SSRFApr 14, 2026
• GHSA-hg7g-56h5-5pqrCAPTCHA Bypass in WWBN/AVideo via Attacker-Controlled Length Parameter and Missing Token Invalidation on FailureApr 14, 2026
• GHSA-8qm8-g55h-xmqrWWBN AVideo is missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creatorsApr 14, 2026