Vulnerabilities and security researches forvod-infomaniak vod-infomaniak

Jun 07, 2024

CVE, Research URL: CVE-2024-33571
Home page URL: Security reports for VOD Infomaniak
Application: VOD Infomaniak
Date: Apr 29, 2024
Research Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak.This issue affects VOD Infomaniak: from n/a through <= 1.5.6.
Affected versions: max 1.5.7.
Status: vulnerable

Oct 17, 2024

CVE, Research URL: CVE-2024-49274
Home page URL: Security reports for VOD Infomaniak
Application: VOD Infomaniak
Date: Oct 20, 2024
Research Description: Cross-Site Request Forgery (CSRF) vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Cross Site Request Forgery.This issue affects VOD Infomaniak: from n/a through <= 1.5.7.
Affected versions: max 1.5.8.
Status: vulnerable

Jan 16, 2025

CVE, Research URL: CVE-2025-22729
Home page URL: Security reports for VOD Infomaniak
Application: VOD Infomaniak
Date: Jan 15, 2025
Research Description: Missing Authorization vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VOD Infomaniak: from n/a through <= 1.5.9.
Affected versions: max 1.5.10.
Status: vulnerable

Nov 10, 2025

CVE, Research URL: CVE-2025-62020
Home page URL: Security reports for VOD Infomaniak
Application: VOD Infomaniak
Date: Oct 22, 2025
Research Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak.This issue affects VOD Infomaniak: from n/a through <= 1.5.11.
Affected versions: max 1.5.12.
Status: vulnerable

Oct 26, 2026

CVE, Research URL: CVE-2026-114695
Home page URL: Security reports for VOD Infomaniak
Application: VOD Infomaniak
Date: Oct 24, 2026
Research Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Stored XSS.This issue affects VOD Infomaniak: from n/a through 1.5.14.
Affected versions: max 1.5.15.
Status: vulnerable

Nov 07, 2026

CVE, Research URL: CVE-2026-115831
Home page URL: Security reports for VOD Infomaniak
Application: VOD Infomaniak
Date: Nov 06, 2026
Research Description: The VOD Infomaniak plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.15. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to initiate unauthorized video imports using the site owner's Infomaniak API credentials, consume the site owner's VOD account quota, and insert arbitrary rows into the wp_vod_upload table causing public shortcodes to resolve to attacker-chosen video content. This action is explicitly reserved for Contributor-level and above by the plugin's own role-rights system, meaning subscriber access is intentionally forbidden by design — the AJAX handler simply omits the enforcement.
Affected versions: max 1.5.16.
Status: vulnerable