# Wwbn Avideo


- [CVE-2026-40911](https://insights.sbomify.com/CVE-2026-40911/): WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks (critical 10.0)
- [CVE-2026-33478](https://insights.sbomify.com/CVE-2026-33478/): AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection (critical 10.0)
- [CVE-2022-30534](https://insights.sbomify.com/CVE-2022-30534/): Command injection in AVideo (critical 9.9)
- [CVE-2022-30547](https://insights.sbomify.com/CVE-2022-30547/): Path traversal in AVideo (critical 9.9)
- [CVE-2022-32572](https://insights.sbomify.com/CVE-2022-32572/): Command injection in AVideo (critical 9.9)
- [CVE-2026-33352](https://insights.sbomify.com/CVE-2026-33352/): AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass) (critical 9.8)
- [CVE-2026-28501](https://insights.sbomify.com/CVE-2026-28501/): WWBN AVideo: Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php (critical 9.8)
- [CVE-2024-31819](https://insights.sbomify.com/CVE-2024-31819/): WWBN AVideo Remote Code Execution (critical 9.8)
- [CVE-2023-47862](https://insights.sbomify.com/CVE-2023-47862/): Path traversal in AVideo (critical 9.8)
- [CVE-2023-49599](https://insights.sbomify.com/CVE-2023-49599/): WWBN AVideo Insufficient Entropy vulnerbaility (critical 9.8)
- [CVE-2023-25313](https://insights.sbomify.com/CVE-2023-25313/): AVideo contains Command injection when embedding a video link (critical 9.8)
- [CVE-2025-41420](https://insights.sbomify.com/CVE-2025-41420/): Cross-site scripting in AVideo (critical 9.6)

---
From sbomify Insights: https://insights.sbomify.com/products/wwbn/avideo/