AVideo's Video Moderator Privilege Escalation via Ownership Transfer Enables Arbitrary Video Deletion

Published 2026-03-23 by GitHub_M

AVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission Modification

Published 2026-03-23 by GitHub_M

AVideo Vulnerable to OS Command Injection via Unsanitized `users_id` and `liveTransmitionHistory_id` in Restreamer Log File Path

Published 2026-03-23 by GitHub_M

AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload

Published 2026-03-23 by GitHub_M

AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP)

Published 2026-03-23 by GitHub_M

AVideo has an unauthenticated decrypt oracle leaking any ciphertext

Published 2026-03-23 by GitHub_M

Hardcoded Cryptographic Key in Configuration Encryption Mechanism on TP-Link Archer NX200, NX210, NX500 and NX600

Published 2026-03-23 by TPLink

Command Injection in Modem Management CLI on TP-Link Archer NX200, NX210, NX500 and NX600

Published 2026-03-23 by TPLink

Command Injection in Wireless Control CLI on TP-Link Archer NX200, NX210, NX500 and NX600

Published 2026-03-23 by TPLink

Authorization Bypass in HTTP Server Endpoints on TP-Link Archer NX200, NX210, NX500 and NX600

Published 2026-03-23 by TPLink