WWBN AVideo-Encoder
10 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-61575 | < 8.1.0 | AVideo-Encoder vulnerable to stored DOM cross-site scripting through queue titles | MEDIUM 4.7 | 0.2 % | ||
| CVE-2026-61569 | < 8.1.0 | AVideo-Encoder: pre-authentication streamer-login SQL injection | HIGH 7.5 | 0.3 % | ||
| CVE-2026-61571 | < 8.1.0 | AVideo-Encoder: missing authentication on control and status endpoints | HIGH 7.3 | 0.3 % | ||
| CVE-2026-61572 | < 8.1.0 | AVideo-Encoder: unauthenticated full-response server-side request forgery | HIGH 8.6 | 0.3 % | ||
| CVE-2026-61573 | < 8.1.0 | AVideo-Encoder: reflected cross-site scripting in the login interface | MEDIUM 6.1 | 0.3 % | ||
| CVE-2026-61567 | < 8.1.0 | AVideo-Encoder: unauthenticated command execution through streamer login trust | CRITICAL 10.0 | 0.5 % | ||
| CVE-2026-61564 | < 8.1.0 | AVideo-Encoder: unauthenticated installer PHP code injection | CRITICAL 10.0 | 0.5 % | ||
| CVE-2026-33025 | < 8.0 | AVideo-Encoder is Vulnerable to Authenticated SQL Injection via ORDER BY Clause | HIGH 8.6 | 0.4 % | ||
| CVE-2026-33024 | < 8.0 | AVideo-Encoder has Unauthenticated Blind Server-Side Request Forgery via Public Thumbnail Generator | CRITICAL 9.3 | 0.4 % | ||
| CVE-2026-29058 | < 7.0 | AVideo: Unauthenticated OS Command Injection via base64Url in objects/getImage.php | CRITICAL 9.8 | 8.8 % |