{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"26.0"}],"component":"wwbn/avideo","cve_ids":[],"ecosystem":"Packagist","exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-wxjx-r2j2-96fx","id":"tcs_01M5KFAFZZ74EZ1EEX1J2SEE2V","modified_at":"2026-03-25T20:16:35.478780Z","published_at":"2026-03-25T19:53:55Z","references":["https://osv.dev/vulnerability/GHSA-wxjx-r2j2-96fx","https://github.com/WWBN/AVideo/security/advisories/GHSA-wxjx-r2j2-96fx","https://github.com/WWBN/AVideo/commit/c95eafbdfccd5959c546a430c32fb3b6026f39ac","https://github.com/WWBN/AVideo"],"severity":{"label":"medium","score":4.9},"sources":[{"source":"osv","source_id":"GHSA-wxjx-r2j2-96fx","url":"https://osv.dev/vulnerability/GHSA-wxjx-r2j2-96fx"}],"summary":"AVideo: Full-Read SSRF Through Unvalidated statsURL Parameter in plugin/Live/test.php"}