Worldwide Broadcast Network AVideo 14.4
Approved changes feed: RSS · Atom
cpe:2.3:a:wwbn:avideo:14.4:*:*:*:*:*:*:*part: a version: 14.4 update: *
| Vendor | Wwbn (5fd054a1-65a6-5c7a-b69d-789a918791b2) |
|---|---|
| Product | Avideo (9661ece6-3566-5d49-8e5d-0b77ccacf0fd) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from NVD CPE 2.0 feed
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/wwbn/avideo |
purl2cpe | 2026-06-01 10:18:10.324332 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-72747 |
vulnerable | 2026-09-16 04:33:08.975365 |
AVideo Stored Cross-Site Scripting via Unauthenticated Registration
HIGH (7.2)
AVideo fails to sanitize the phone field during user registration, allowing unauthenticated attackers to inject malicious JavaScript that persists in the database. When administrators visit the users management page, the unsanitized phone value is rendered via innerHTML, executing the injected script in the admin's browser session.
Published: 2026-08-11T12:17:01.441Z
Updated: 2026-08-11T17:59:50.727Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-72748 |
vulnerable | 2026-09-16 04:33:08.428020 |
AVideo Unauthenticated Arbitrary File Write via aVideoEncoderChunk.json.php
CRITICAL (9.1)
AVideo contains an unauthenticated arbitrary file write vulnerability in the aVideoEncoderChunk.json.php endpoint that allows remote attackers to write up to 4 GB of arbitrary content to the server filesystem via HTTP PUT requests without authentication. Attackers can exhaust disk space causing denial of service, poison the video encoding pipeline, or chain this with local file inclusion to achieve remote code execution.
Published: 2026-08-11T12:17:02.126Z
Updated: 2026-08-11T14:12:04.222Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-53084 |
vulnerable | 2026-06-08 07:31:13.926745 |
Details available
CRITICAL (9)
A cross-site scripting (xss) vulnerability exists in the videosList page parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this vulnerability.
Published: 2025-07-24T15:11:04.747Z
Updated: 2025-11-03T20:06:19.663Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-50128 |
vulnerable | 2026-06-08 07:31:10.479203 |
Details available
CRITICAL (9.6)
A cross-site scripting (xss) vulnerability exists in the videoNotFound 404ErrorMsg parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this vulnerability.
Published: 2025-07-24T15:11:03.304Z
Updated: 2025-11-03T20:05:42.224Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-48732 |
vulnerable | 2026-06-08 07:29:11.345743 |
Details available
HIGH (7.3)
An incomplete blacklist exists in the .htaccess sample of WWBN AVideo 14.4 and dev master commit 8a8954ff. A specially crafted HTTP request can lead to a arbitrary code execution. An attacker can request a .phar file to trigger this vulnerability.
Published: 2025-07-24T15:10:56.720Z
Updated: 2025-11-03T20:04:54.914Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-46410 |
vulnerable | 2026-06-08 07:27:08.188087 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-41420 |
vulnerable | 2026-06-08 07:25:07.022784 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-36548 |
vulnerable | 2026-06-08 07:21:01.883382 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-25214 |
vulnerable | 2026-06-08 07:12:50.850856 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.