Worldwide Broadcast Network AVideo 21.0
Approved changes feed: RSS · Atom
cpe:2.3:a:wwbn:avideo:21.0:*:*:*:*:*:*:*part: a version: 21.0 update: *
| Vendor | Wwbn (5fd054a1-65a6-5c7a-b69d-789a918791b2) |
|---|---|
| Product | Avideo (9661ece6-3566-5d49-8e5d-0b77ccacf0fd) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from NVD CPE 2.0 feed
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/wwbn/avideo |
purl2cpe | 2026-07-28 16:41:17.304763 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-72747 |
vulnerable | 2026-09-16 04:33:08.970175 |
AVideo Stored Cross-Site Scripting via Unauthenticated Registration
HIGH (7.2)
AVideo fails to sanitize the phone field during user registration, allowing unauthenticated attackers to inject malicious JavaScript that persists in the database. When administrators visit the users management page, the unsanitized phone value is rendered via innerHTML, executing the injected script in the admin's browser session.
Published: 2026-08-11T12:17:01.441Z
Updated: 2026-08-11T17:59:50.727Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-72748 |
vulnerable | 2026-09-16 04:33:08.420866 |
AVideo Unauthenticated Arbitrary File Write via aVideoEncoderChunk.json.php
CRITICAL (9.1)
AVideo contains an unauthenticated arbitrary file write vulnerability in the aVideoEncoderChunk.json.php endpoint that allows remote attackers to write up to 4 GB of arbitrary content to the server filesystem via HTTP PUT requests without authentication. Attackers can exhaust disk space causing denial of service, poison the video encoding pipeline, or chain this with local file inclusion to achieve remote code execution.
Published: 2026-08-11T12:17:02.126Z
Updated: 2026-08-11T14:12:04.222Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.