Mittel
CVE-2026-30878
Schwachstellenarchiv
Schwachstellen verstehen. Anwendungen schützen.
Erfahren Sie, welche Schwachstellen Ihre Technologien betreffen und wie Sie diese beheben. Hier finden Sie verständliche Erklärungen, betroffene Versionen und konkrete Empfehlungen - von CMS und Plugins bis zu Anwendungsbibliotheken.
Schwachstellenarchiv 423
Filter zurücksetzen
Kritisch
CVE-2026-30877
baserCMS Update Functionality Vulnerable to OS Command Injection
Mittel
CVE-2026-27697
baserCMS has an SQL injection vulnerability in its blog post functionality
Kritisch
CVE-2026-21861
baserCMS has OS Command Injection Leading to Remote Code Execution (RCE)
Hoch
CVE-2025-32957
baserCMS has Unsafe File Upload Leading to Remote Code Execution (RCE)
Hoch
CVE-2026-34375
AVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment Page
Mittel
CVE-2026-34368
AVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalance
Mittel
CVE-2026-34362
AVideo's WebSocket Token Never Expires Due to Commented-Out Timeout Validation in verifyTokenSocket()
Kritisch
CVE-2026-27599
ci4-cms-erp/ci4ms: System Settings (Mail Settings) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Mittel
CVE-2026-34247
AVideo: IDOR in uploadPoster.php Allows Any Authenticated User to Overwrite Scheduled Live Stream Posters and Trigger False Socket Notifications
Hoch
CVE-2026-33770
AVideo has SQL Injection in category.php fixCleanTitle() via Unparameterized clean_title and id Variables
Mittel
CVE-2026-33688
AVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery Endpoint
Mittel
CVE-2026-33685
AVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User Data
Hoch
CVE-2026-33507
AVideo Affected by CSRF on Plugin Import Endpoint Enables Unauthenticated Remote Code Execution via Malicious Plugin Upload
Kritisch
CVE-2026-33502
AVideo has Unauthenticated SSRF via plugin/Live/test.php
Mittel
CVE-2026-33500
AVideo - Incomplete Fix for CVE-2026-27568: Stored XSS via Markdown `javascript:` URI Bypasses ParsedownSafeWithLinks Sanitization
Hoch
CVE-2026-33485
AVideo has an Unauthenticated Blind SQL Injection in RTMP on_publish Callback via Stream Name Parameter
Hoch
CVE-2026-33482
AVideo has an OS Command Injection via $() Shell Substitution Bypass in sanitizeFFmpegCommand()
Hoch
CVE-2026-33479
AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin
Kritisch
CVE-2026-33478
AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection
Hoch
CVE-2026-33354
AVideo has an authenticated arbitrary local file read via `chunkFile` path injection in `aVideoEncoder.json.php`
Hoch
CVE-2026-33295
AVideo Affected by Stored XSS via Unescaped Video Title in CDN downloadButtons.php
Hoch
CVE-2026-33292
AVideo has an Authorization Bypass via Path Traversal in HLS Endpoint Allows Streaming Private/Paid Videos
Mittel
CVE-2026-33319
AVideo has an OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command
Erkennen Sie Schwachstellen in Ihrer Anwendung
Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.