Please report security issues to developer@streamphp.com
Repository navigation
Security: WWBN/AVideo
Security
.github/SECURITY.md
-
Unauthenticated PHP file inclusion via Accept-Language traversal bypassGHSA-r3jc-85h3-h7g2 published
Oct 12, 2026 by DanielnetoDotComHigh -
Stored XSS in AVideo comment Markdown block HTML renderingGHSA-cx46-26xc-2w7f published
Oct 8, 2026 by DanielnetoDotComModerate -
Delegated Users Admin can delete or modify administrator accountsGHSA-mp89-8x4j-2grx published
Oct 7, 2026 by DanielnetoDotComModerate -
Blind SSRF via redirect-following in getHeaderContentTypeFromURL() (bypasses isSSRFSafeURL)GHSA-m8q2-35pq-qrmc published
Oct 7, 2026 by DanielnetoDotComLow -
CSRF on legacy playlist/video endpoints whose filenames don't match the `.json.php` auto-guard patternGHSA-9pf9-6jr6-fvjr published
Oct 6, 2026 by DanielnetoDotComLow -
WWBN AVideo through 29.2.0 Stored XSS via Video trailer1 in YouPHPFlix2 TemplatesGHSA-6wfr-c7fw-4xvw published
Oct 4, 2026 by DanielnetoDotComHigh -
WWBN AVideo through 29.2.0 Stored XSS via Double-Encoded Video TitleGHSA-q62w-927x-vhhf published
Oct 4, 2026 by DanielnetoDotComHigh -
Stored XSS in video trailer1 field via HTML-entity bypass of isValidURL()GHSA-v7vx-v9q9-qhw3 published
Sep 11, 2026 by DanielnetoDotComModerate -
Use of a cryptographically weak PRNG: RTMP publish keys are raw `uniqid()` values derived from the transmission creation timeGHSA-h983-2mcw-672j published
Sep 2, 2026 by DanielnetoDotComModerate -
Use of a cryptographically weak PRNG: `getRandomCode()` activation codes are a pure function of server microtime, and redeeming one returns a one-year authentication tokenGHSA-v65f-hc7x-wj62 published
Sep 2, 2026 by DanielnetoDotComHigh
Learn more about advisories related to WWBN/AVideo in the GitHub Advisory Database