Avideo

This hub aggregates every CVE we track for Avideo, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Avideo.

• CVE-2026-64626AVideo Encoder downloadURL SSRF via unpinned retry fallback6.4Jul 20, 2026
• CVE-2026-64625AVideo before 29.0 OS Command Injection via execAsync9.8Jul 20, 2026
• CVE-2026-33731AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data6.5Jul 16, 2026
• CVE-2026-55173AVideo incomplete fix for CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command execution at the same execAsync sh -c sink8.1Jul 16, 2026
• CVE-2026-33692AVideo Has Unauthenticated .env File Exposure via Official Docker Compose Configuration7.5Jul 16, 2026
• CVE-2026-63305AVideo through 29.0 OS Command Injection via ffmpeg.json.php8.1Jul 16, 2026
• CVE-2026-63304AVideo through 29.0 OS Command Injection via listFFmpegProcesses8.1Jul 16, 2026
• CVE-2026-54458AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin9.6Jul 15, 2026
• CVE-2026-50183WWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery Section4.7Jul 15, 2026
• CVE-2026-50182AVideo Has Unauthenticated Reflected XSS via $_GET['search'] in YouTubeAPI Gallery Pagination6.1Jul 15, 2026
• CVE-2026-33684AVideo's Privilege AVideo: Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet Permissions5.3Jul 15, 2026
• CVE-2026-60092AVideo - Stored Cross-Site Scripting via Unescaped User-Agent in Participants Panel6.1Jul 8, 2026
• CVE-2026-56347AVideo TopMenu Plugin - Stored Cross-Site Scripting via Unescaped Menu Item Fields6.1Jun 20, 2026
• CVE-2026-56345AVideo - Arbitrary User Session Hijacking via Meet Plugin uploadRecordedVideo Endpoint8.1Jun 20, 2026
• CVE-2026-56346AVideo - Unauthenticated PGP Message Decryption via decryptMessage.json.php Endpoint6.5Jun 20, 2026