WWBN AVideo vulnerabilities

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in UserGroups::setGroup_name() that fails to sanitize group_name input. Administrators with canAdminUserGroups permission can inject malicious HTML and JavaScript that executes in the browser when other administrators access the user manager interface.

WWBN AVideo is an open source video platform that, in versions up to 29.0, allows unauthenticated users to read APISecret from objects/plugins.json.php. This enables them to call protected API endpoints, such as users_list, without logging in.

WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery tokens, and live session identifiers to unauthenticated callers when a hash parameter is provided. Attackers can use the disclosed session identifier to hijack viewer sessions, including administrator accounts, and obtain sensitive personal data for all video viewers.

WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by supplying a caller-chosen path in the avideoRelativePath parameter. Attackers can replay any previously issued ciphertext as a notifyCode token, which is decrypted but never validated, to bypass authentication and write files to the application root and subdirectories.

WWBN AVideo contains an authentication failure vulnerability where the video_id_hash credential is a non-expiring, non-revocable bearer token that grants full administrator session access to the video owner's account. Attackers who obtain a video_id_hash can replay it indefinitely to authenticate as the video owner with full privileges, and the credential remains valid even after the owner changes their password.

WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 URL. The value is rendered unescaped in YouPHPFlix2 templates and channel playlists, letting attackers break out of onclick strings or iframe src attributes to execute JavaScript in victims' browsers.

WWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows authenticated uploaders to inject HTML by submitting doubly-encoded entities in video titles. Because safeString() strips tags before decoding entities and runs twice via setTitle() and save(), attackers can store markup that executes in trending, gallery, embed, and playlist pages.

WWBN AVideo through commit e01e41ecc contains a broken access control flaw in objects/userVerifyEmail.php. The script disables the login requirement, takes users_id directly from the query string and calls User::sendVerificationLink() with no session, CSRF token, relationship check or rate limit, allowing an unauthenticated attacker to send unlimited verification emails, enumerate accounts and write password-recovery tokens onto victim accounts.

WWBN AVideo through 29.0 fails to enforce user-group restrictions in the plugin/Live/stats.json.php and plugin/Live/calendar.json.php endpoints. Unauthenticated attackers can retrieve restricted live transmission details including stream keys, titles, descriptions, owner information, and direct HLS playback URLs by accessing these endpoints.

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate playlist ownership in the Playlists_schedules/list.json.php and Live/calendar.json.php endpoints, allowing authenticated and unauthenticated users to read private playlist schedule metadata. Attackers with canStream privileges or no authentication can retrieve schedule names, descriptions, timestamps, and playlist identifiers by querying these endpoints without ownership checks.

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate playlist ownership in the video_from_program API endpoint, allowing unauthenticated access to private playlist contents. Attackers can query the API without authentication to enumerate private playlist names, owner information, and video titles including password-protected content.

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to check user authorization in the PlayerSkins mediaSession.json.php endpoint before returning video metadata. Unauthenticated attackers can request the endpoint with a video ID parameter to retrieve password-protected video titles and owner email addresses without authentication.

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to properly authorize access to the videosAndroid.json.php endpoint, allowing unauthenticated guests to list password-protected videos with sensitive owner information. Attackers can retrieve video metadata including owner email, lastLogin, filename, and hashId by sending an unauthenticated GET request to the endpoint.

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate user permissions in the ImageGallery list.json.php endpoint, allowing unauthenticated access to list gallery files. Attackers can retrieve filenames and URLs of password-protected image galleries by directly accessing the endpoint, then fetch the exposed files without authentication.

The Bookmark plugin in WWBN AVideo fails to validate user permissions in the getBookmarks.json.php endpoint. Unauthenticated attackers can read chapter names from password-protected videos by supplying a video ID parameter.

The like.json.php endpoint in WWBN AVideo fails to validate video access permissions. Logged-in users can record likes on password-protected and group-restricted videos, incrementing like counters without being able to watch the content.

The commentAddNew.json.php endpoint in WWBN AVideo fails to validate video access permissions. Authenticated users can post comments on password-protected and group-restricted videos, bypassing password and group access controls.

The videoAddViewCount.json.php endpoint in WWBN AVideo fails to validate video access permissions before updating view statistics. Authenticated attackers can increment view counts and watch-time on videos they cannot access by submitting arbitrary video IDs.

The Live plugin in WWBN AVideo contains a missing authentication vulnerability in plugin/Live/socketMessageLiveOwner.json.php. An unauthenticated attacker who knows an administrator's Live stream key can deliver arbitrary in-app notification messages to that administrator, with no login check or CSRF token.

The remindMe.json.php endpoint in WWBN AVideo fails to validate that logged-in users can access live schedules before creating reminders. Authenticated attackers can create reminders for private live schedules they cannot view and learn the private schedule title from the generated email job.

The plugin/TopMenu/menus.json.php endpoint in WWBN AVideo does not require authentication. Unauthenticated attackers can retrieve all menu data, including inactive and admin-only menu names not displayed in the public navbar.

The playListAddVideo.json.php endpoint in WWBN AVideo fails to validate watch permissions when adding videos to playlists. Authenticated attackers can add password-protected videos they cannot watch to playlists they own by submitting video ID and playlist ID parameters.

The plugin/TopMenu/menuItems.json.php endpoint in WWBN AVideo contains a missing authentication vulnerability. Unauthenticated attackers can read inactive admin menu items by submitting a POST request with a menuId parameter, including hidden menu item URLs with embedded admin-tool secret query parameters not exposed in the public navbar.

The playlistsFromUser.json.php endpoint in WWBN AVideo contains a missing authorization vulnerability. Unauthenticated attackers can read private playlists by requesting another user's identifier, including Favorite and Watch Later playlists, due to improper cache keying that conflates requests across different user contexts.

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/Scheduler/sendEmail.json.php that allows unauthenticated attackers to access scheduler email jobs by providing a site-wide daily token. Attackers can enumerate scheduler jobs, read private live titles and email addresses, and trigger email sending by supplying any valid daily token obtained from Live pages.

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to authorize access to the adsInfo API endpoint. An unauthenticated attacker can call adsInfo with a videos_id parameter to obtain the owner's user ID and personalized ad creative URLs without any permission checks.

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a server-side request forgery vulnerability in the _json_decode function that fetches remote URLs and local file paths without SSRF validation. Unauthenticated attackers can POST file paths or HTTP URLs to login.json.php to read local files or access internal services, with results parsed as login credentials.

WWBN AVideo through commit e01e41ecc (no patched version available) exposes get_api_preauthorize in plugin/API/API.php as a second, undocumented login path. Unlike get_api_signIn, which enforces a rate limit of 10 attempts per 5 minutes via checkRateLimit(), get_api_preauthorize performs the same credential check with no throttling for any client, allowing unlimited remote password guessing against arbitrary accounts, including admin. The endpoint also acts as a credential oracle: it returns the message "Invalid credentials" for both correct and incorrect passwords, while the users_id field in the response body discloses the authenticated identity (users_id:1 on success, users_id:0 on failure), and a correct password establishes a session cookie that remains usable for authenticated API requests. Together these issues permit unauthenticated brute-force account takeover.

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ownership of live_restreams_id in resendRestreamer.json.php, allowing authenticated users with canStream to access other users' restream destinations. Attackers can broadcast their live stream to victim-configured restream destinations by supplying arbitrary live_restreams_id values, hijacking YouTube, Facebook, or Twitch streams using victim stream keys.

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in deleteHistory.json.php and finishAll.json.php that allows unauthenticated attackers to mutate live history by making GET requests without CSRF token validation. Attackers can craft malicious pages that trigger administrator browsers to delete all live transmission history or mark streams as finished when an admin visits the attacker-controlled site.

WWBN AVideo contains a broken access control vulnerability in the unauthenticated feed/index.php endpoint that disables per-video visibility checks when a program_id parameter is supplied. Attackers can enumerate playlist identifiers and retrieve unlisted and group-restricted videos by requesting the RSS feed with any visible playlist id, including empty playlists that return the entire site's hidden video catalogue.

WWBN AVideo fails to properly validate access controls on the public channel page, allowing unauthenticated visitors to view unlisted and group-restricted videos through hardcoded visibility flags and an undefined property. Attackers can access the channel endpoint to retrieve sensitive video content that should be hidden, including full URLs to unlisted videos and thumbnails of member-only content, regardless of the operator's hidePrivateVideos setting.

WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php endpoint with APIName=channels that allows unauthenticated attackers to order results by arbitrary database columns including users.password and users.recoverPass. Attackers can exploit this ordering oracle to infer password hash values and recovery tokens, and trigger SQL errors that disclose the full query statement and database schema.

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the get_domain() and isSameDomain() functions that fail to properly validate referer origins. Attackers can forge requests from sibling subdomains or unparseable long-gTLD origins to perform administrative ObjectYPT writes including live server configuration changes.

WWBN AVideo contains a path traversal vulnerability in the API get_api_login_code endpoint that allows unauthenticated attackers to delete arbitrary .log files by supplying directory traversal sequences in the code parameter. Attackers can exploit this to destroy audit logs and probe for file existence on the server, with the vulnerability enabling both file deletion and information disclosure about the filesystem.

WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers to spoof the client address used by enforceRateLimit(). Attackers can rotate the header value per request to bypass login rate limiting and perform unlimited credential guessing attacks.

WWBN AVideo contains a cross-site request forgery vulnerability in sendEmail.json.php that allows authenticated administrators to send mail from the site's contact address by bypassing origin checks and captcha validation. Attackers can craft a malicious web page that, when visited by an authenticated admin, sends emails with attacker-controlled subject and body to arbitrary recipients, passing SPF/DKIM/DMARC validation for phishing and brand impersonation attacks.

WWBN AVideo contains an unauthenticated reflected cross-site scripting vulnerability in the url2Embed.json.php endpoint that allows attackers to inject malicious scripts by supplying URLs with HTML metacharacters. Attackers can mint an encrypted evideo payload containing unescaped markup, then deliver it as a legitimate-looking link on the site's own domain to execute JavaScript in victims' sessions and steal cookies or CSRF tokens.

WWBN AVideo (up to e01e41ecc and earlier) contains a brute-force rate limiting bypass in enforceRateLimit(), which protects login.json.php and 13 other endpoints. The attempt counter is stored via a cache layer that silently discards writes for clients identified as bots by isBot(). Since isBot() treats a missing User-Agent header as a bot, an attacker can submit unlimited login attempts, enabling unrestricted password-guessing attacks.

WWBN AVideo contains an unauthenticated credential submission vulnerability in plugin/Live/api/preauthorize.json.php that accepts credentials over GET without rate limiting. Attackers can submit correct credentials repeatedly to trigger uncapped two-factor confirmation emails and perform sustained password guessing attacks against user accounts.

WWBN AVideo versions 29.0 and below are vulnerable to OS command injection. The fix for CVE-2026-33482 was incomplete and does not neutralize a single & (shell background operator), allowing multiple commands to be chained.

In WWBN AVideo prior to version 29.0, a vulnerability in the Authorize.Net webhook handler allows an attacker to bypass signature verification and forge webhook requests with arbitrary payment amounts and target user IDs. The attacker can credit arbitrary wallet balances to any user without a corresponding payment and activate premium subscriptions, leading to free access to paid content and direct revenue loss.

A privilege escalation vulnerability in WWBN AVideo prior to version 29.0 allows any user who can solve a CAPTCHA to self-grant elevated permissions during registration via unguarded API parameters. Attackers can mark accounts as email-verified and obtain upload, streaming, and meeting creation rights.

In WWBN AVideo version 29.0 and earlier, the endpoint plugin/AuthorizeNet/processPayment.json.php credits the user's wallet based solely on the attacker-controlled amount parameter, without validating any Authorize.Net transaction. This allows any logged-in user to add arbitrary funds to their AVideo wallet.

WWBN AVideo in version 29.0 and earlier stores category descriptions from user input and renders them as raw HTML in the Gallery view. A user who can create or edit categories can store JavaScript in a category description, which executes when another user views the affected page. This is a stored XSS vulnerability in the category description field.

WWBN AVideo is an open source video platform. In 29.0 and earlier, an unauthenticated remote attacker can read arbitrary image files anywhere on disk that the PHP user can open — including private user-profile photos that the application's normal serving wrappers gate behind ACLs, admin-uploaded thumbnails, encrypted-video poster frames, and image content under sibling-app directories reachable via .. traversal. The endpoint requires no authentication.

In WWBN AVideo (version 29.0 and earlier), view/update.php reads $_POST['updateFile'] as a relative path under updatedb/ and passes it to PHP's file() for line-by-line execution as part of a database migration. An authenticated administrator can abuse this to read arbitrary text files reachable from the web-server process.

In WWBN AVideo 29.0 and earlier, the file objects/mention.json.php lacks authentication checks or an admin gate. It only has a simple entry guard: preg_match('/^@/', $_REQUEST['term']) and a hard-coded rowCount=10. This allows unauthenticated user enumeration.

WWBN AVideo in version 29.0 and earlier does not use the $resolvedIP out-param of isSSRFSafeURL() for DNS pinning via CURLOPT_RESOLVE in EpgParser.php, plugin/AI/receiveAsync.json.php, and other locations. This opens a DNS-rebinding TOCTOU vulnerability.

WWBN AVideo version 29.0 and earlier contains a cross-site request forgery (CSRF) vulnerability in the 2FA toggle. An attacker can use a hidden form or fetch request without credentials to disable the victim's 2FA with a single POST request.