CVE Vulnerability Catalog

WWBN AVideo up to version 26.0 has a vulnerability in the User_Location plugin's testIP.php page that reflects the ip parameter without output encoding, allowing arbitrary HTML and JavaScript injection. Although the page is restricted to admins, the SameSite=None cookie configuration allows cross-origin exploitation. No public patches are available.

WWBN AVideo versions 26.0 and prior accept an overrideStatus request parameter that allows any uploader to set a video's status to any valid state, including "active" (a). This bypasses admin-controlled moderation and draft workflows. The setStatus() method does not verify that the caller has permission to set that particular status.

WWBN AVideo versions 26.0 and prior have a vulnerability in the StripeYPT plugin. The test.php endpoint is accessible to any logged-in user, not just administrators. Due to a bug in the retrieveSubscriptions() method that cancels subscriptions instead of retrieving them, any authenticated user can cancel arbitrary Stripe subscriptions by providing a subscription ID.

A vulnerability was found in AVideo version 26.0 and earlier in the install/deleteSystemdPrivate.php script. Due to a PHP operator precedence bug, the condition !php_sapi_name() === 'cli' always evaluates to false, allowing remote unauthenticated access to the script, which deletes files from the temp directory and discloses its contents.

WWBN AVideo versions 26.0 and prior have a vulnerability in the CreatePlugin template for list.json.php, which lacks authentication or authorization checks. This results in 21 unauthenticated endpoints exposing sensitive data including user PII, payment transaction logs, IP addresses, and user agents.

WWBN AVideo versions 26.0 and prior have an XSS vulnerability in the YPTSocket plugin. The caller feature passes the caller's display name directly as raw HTML into the jQuery Toast Plugin. An attacker can set their display name to an XSS payload, and upon initiating a call, the code executes in any online user's browser without interaction.

WWBN AVideo allows admins to enable/disable plugins via objects/pluginSwitch.json.php without CSRF validation and bypassing Referer/Origin checks. An attacker can disable critical security plugins (e.g., 2FA) by luring an admin to a malicious page.

WWBN AVideo version 26.0 and prior allows admins to send HTML emails to all users via the objects/emailAllUsers.json.php endpoint. No CSRF token validation and SameSite=None on session cookies enable cross-origin CSRF attacks.

PdfDing prior to version 1.7.1 does not check in check_shared_access_allowed() whether a shared PDF is inactive (expired, reached view limit) or deleted. Previously authorized users can still access the PDF after expiration or deletion.

WWBN AVideo versions 26.0 and prior do not encode plugin configuration values before rendering in the admin panel. The jsonToFormElements() function in admin/functions.php directly interpolates user data into HTML elements, allowing arbitrary JavaScript injection.

WWBN AVideo versions 26.0 and prior have a vulnerability in the endpoint plugin/YPTWallet/view/users.json.php, which returns personal information and wallet balances of all users to any authenticated user. There is no admin privilege check.

Admidio prior to version 5.0.8 contains a CSRF vulnerability in the registration module. Approval actions for pending registrations (create_user, assign_member, assign_user) are performed via GET requests without CSRF token validation, allowing an attacker to auto-approve their own registration by tricking an administrator with appropriate rights.

Admidio before version 5.0.8 contains a vulnerability in the inventory module where the item_save endpoint accepts a user-controllable POST parameter imported that, when set to true, completely bypasses CSRF token validation and server-side form validation. An authenticated user can craft a direct POST request to save arbitrary inventory item data without CSRF protection and without the field value checks that the FormPresenter validation normally enforces.

Admidio before version 5.0.8 does not validate a CSRF token in the delete mode handler in mylist_function.php. An attacker can trick an authenticated user into visiting a malicious page, leading to permanent deletion of list configurations, including organization-wide shared lists if the victim has administrator rights.

Parse Server prior to versions 8.6.63 and 9.7.0-alpha.7 returns unsanitized authentication data from the verify password endpoint, including MFA TOTP secrets, recovery codes, and OAuth tokens. An attacker who knows the user's password can extract the MFA secret and generate valid MFA codes.

Captcha Protect, a Traefik middleware, is vulnerable to reflected XSS. The challenge page accepts a client-supplied destination value and renders it into HTML using Go's text/template, which does not perform contextual HTML escaping.

In the Video player Play All Videos v1.0.135 by RAREPROB SOLUTIONS PRIVATE LIMITED, an arbitrary file overwrite vulnerability exists during the file import process. An attacker can overwrite critical internal files, leading to arbitrary code execution or information disclosure.

Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for CVE-2025-13465 only guarded against string key members, but an attacker can bypass it by using array-wrapped path segments. This allows deletion of properties from built-in prototypes like Object.prototype.

In SourceCodester Loan Management System v1.0, there is a business logic vulnerability due to missing server-side validation. An authenticated attacker can bypass frontend restrictions and submit a negative value for the interest_percentage field, creating loan plans with negative interest rates.

Simple Gym Management System 1.0 is vulnerable to SQL Injection in the Payment Handler component. Parameters Payment_id, Amount, customer_id, payment_type, and customer_name are susceptible to manipulation.