Priority HIGH 77
YouPHPTube <= 7.8 contains a local file inclusion vulnerability that allows unauthenticated attackers to access arbitrary files by manipulating the 'lang' parameter in GET requests.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.01828 · Published 2026-01-13 · No fix listed CWE-22
Priority HIGH 72
A command injection have been found in YouPHPTube Encoder.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.45302 · Published 2019-10-25 · No fix listed CWE-78
Priority HIGH 69
A command injection have been found in YouPHPTube Encoder.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.38531 · Published 2019-10-25 · No fix listed CWE-78
Priority HIGH 66
A command injection have been found in YouPHPTube Encoder.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.30174 · Published 2019-10-25 · No fix listed CWE-78
Priority MEDIUM 64
In YouPHPTube 7.4, the file install/checkConfiguration.php has no access control, which leads to everyone being able to edit the configuration file, and insert malicious PHP code.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.27581 · Published 2019-09-09 · No fix listed CWE-862
Priority MEDIUM 56
YouPHPTube <= 7.8 contains a cross-site scripting vulnerability that allows attackers to inject malicious scripts through the redirectUri parameter in the signup page.
CVSS 4.0MEDIUM 5.1· Network · No auth · User interaction · EPSS 0.00363 · Published 2026-01-13 · No fix listed CWE-79
Priority MEDIUM 47
An issue was discovered in YouPHPTube through 7.7.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02314 · Published 2019-11-02 · No fix listed CWE-89
Priority MEDIUM 47
An exploitable SQL injection vulnerability exist in YouPHPTube 7.7.
CVSS 3.1CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.02265 · Published 2019-10-31 · No fix listed CWE-89
Priority MEDIUM 45
An exploitable SQL injection vulnerability exists in the authenticated portion of YouPHPTube 7.6.
CVSS 3.1CRITICAL 9.9· Network · Low privileges · No interaction · EPSS 0.01389 · Published 2019-10-25 · No fix listed CWE-89
Priority MEDIUM 42
An exploitable SQL injection vulnerability exist in YouPHPTube 7.7.
CVSS 3.1HIGH 8.9· Network · No auth · No interaction · EPSS 0.01527 · Published 2019-10-31 · No fix listed CWE-89
Priority MEDIUM 40
Specially crafted web requests can cause SQL injections in YouPHPTube 7.6.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01012 · Published 2019-10-25 · No fix listed CWE-89
Priority MEDIUM 40
SQL injection vulnerabilities exists in the authenticated part of YouPHPTube 7.6.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00847 · Published 2019-10-25 · No fix listed CWE-89
Priority MEDIUM 40
SQL injection vulnerabilities exists in the authenticated part of YouPHPTube 7.6.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01064 · Published 2019-10-25 · No fix listed CWE-89
Priority MEDIUM 40
An exploitable SQL injection vulnerability exists in the authenticated part of YouPHPTube 7.6.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01064 · Published 2019-10-25 · No fix listed CWE-89
Priority MEDIUM 40
An exploitable SQL injection vulnerability exist in the authenticated part of YouPHPTube 7.6.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00966 · Published 2019-10-25 · No fix listed CWE-89
Priority MEDIUM 40
Exploitable SQL injection vulnerabilities exists in the authenticated portion of YouPHPTube 7.6.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01064 · Published 2019-10-25 · No fix listed CWE-89
Priority MEDIUM 40
An exploitable SQL injection vulnerability exists in the authenticated part of YouPHPTube 7.6.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01064 · Published 2019-10-25 · No fix listed CWE-89
Priority LOW 36
AVideo/YouPHPTube AVideo/YouPHPTube 10.0 and prior is affected by a SQL Injection SQL injection in the catName parameter which allows a remote unauthenticated attacker to retrieve databases information such as applicatio…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01749 · Published 2021-11-01 · No fix listed CWE-89
Priority LOW 35
AVideo/YouPHPTube 10.0 and prior is affected by Insecure file write.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.01594 · Published 2021-11-01 · No fix listed CWE-94
Priority LOW 29
AVideo/YouPHPTube 10.0 and prior is affected by multiple reflected Cross Script Scripting vulnerabilities via the videoName parameter which allows a remote attacker to steal administrators' session cookies or perform act…
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00862 · Published 2021-11-01 · No fix listed CWE-79
Priority LOW 29
AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross Script Scripting vulnerabilities via the u parameter which allows a remote attacker to steal administrators' session cookies or perform actions as an administ…
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00869 · Published 2021-11-01 · No fix listed CWE-79
Priority LOW 29
AVideo/YouPHPTube AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross Script Scripting vulnerabilities via the searchPhrase parameter which allows a remote attacker to steal administrators' session cookies or p…
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00869 · Published 2021-11-01 · No fix listed CWE-79
Priority LOW 29
plugin/Audit/Objects/AuditTable.php in YouPHPTube through 7.2 allows SQL Injection.
CVSS 3.0MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.02984 · Published 2019-08-20 · No fix listed CWE-89
THREATIST.IORead the docs