AVideo/YouPHPTube vulnerabilities
5 known CVE vulnerabilities in AVideo/YouPHPTube, translated and rated.
- CVE-2021-25878Medium
AVideo/YouPHPTube 10.0 and prior versions are affected by multiple reflected Cross-Site Scripting (XSS) vulnerabilities via the videoName parameter. This allows a remote attacker to steal administrator session cookies or perform actions as an administrator.
- CVE-2021-25877High
A vulnerability in AVideo/YouPHPTube 10.0 and prior allows insecure file writes. An administrator can write files to the filesystem using flag and code variables in save.php.
- CVE-2021-25876Medium
AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross-Site Scripting (XSS) vulnerabilities via the 'u' parameter. A remote attacker can exploit this to steal administrator session cookies or perform actions as an administrator.
- CVE-2021-25875Medium
AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross-Site Scripting (XSS) vulnerabilities via the searchPhrase parameter. This allows a remote attacker to steal administrators' session cookies or perform actions as an administrator.
- CVE-2021-25874High
A SQL Injection vulnerability in AVideo/YouPHPTube 10.0 and prior allows an unauthenticated remote attacker to inject SQL code via the catName parameter. This enables retrieval of database information, including application password hashes.