CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,499 CVEs published, 356 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,499
Show in the list
Critical, last 7 days
356
Show in the list
Healthcare-tagged, last 7 days
5
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product wwbn:avideo. Show all products

262 CVEs, showing 251 to 262PreviousPage 6 of 6
CVESeverityTitlePublished
CVE-2020-37173High 7.5AVideo Platform 8.1 contains an information disclosure vulnerability that allows attackers to enumerate user details through the playlistsFromUser.json.php endpoint.Feb 11, 2026
CVE-2020-37172Critical 9.8AVideo Platform 8.1 contains a cross-site request forgery vulnerability that allows attackers to reset user passwords by exploiting the password recovery mechanism.Feb 11, 2026
CVE-2020-37158High 8.8AVideo Platform 8.1 contains a cross-site request forgery vulnerability that allows attackers to reset user passwords by exploiting the password recovery mechanism.Feb 11, 2026
CVE-2025-34442High 7.5AVideo versions prior to 20.1 disclose absolute filesystem paths via multiple public API endpoints.Dec 17, 2025
CVE-2025-34441High 7.5AVideo versions prior to 20.1 expose sensitive user information through an unauthenticated public API endpoint.Dec 17, 2025
CVE-2025-34440Medium 6.1AVideo versions prior to 20.1 contain an open redirect vulnerability caused by insufficient validation of the siteRedirectUri parameter during user registration.Dec 17, 2025
CVE-2025-34439Medium 6.1AVideo versions prior to 20.1 are vulnerable to an open redirect flaw due to missing validation of the cancelUri parameter during user login.Dec 17, 2025
CVE-2025-34438High 8.1AVideo versions prior to 20.1 contain an insecure direct object reference vulnerability allowing users with upload permissions to modify the rotation metadata of any video.Dec 17, 2025
CVE-2025-34437High 8.8AVideo versions prior to 20.1 permit any authenticated user to upload comment images to videos owned by other users.Dec 17, 2025
CVE-2025-34436High 8.8AVideo versions prior to 20.1 allow any authenticated user to upload files into directories belonging to other users due to an insecure direct object reference.Dec 17, 2025
CVE-2025-34435Medium 6.5AVideo versions prior to 20.1 are vulnerable to an insecure direct object reference (IDOR) that allows any authenticated user to delete media files belonging to other users.Dec 17, 2025
CVE-2025-34434Critical 9.1AVideo versions prior to 20.1 with the ImageGallery plugin enabled is vulnerable to unauthenticated file upload and deletion.Dec 17, 2025
PreviousPage 6 of 6

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.