AVideo is a video-sharing Platform. Before the initial remediation attempt in 8.1.0, "url_get_contents" in "objects/functions.php" accepts caller-controlled destinations after only "FILTER_VALIDATE_URL" syntax validation, without rejecting private, loopback, or link-local addresses, and disables TLS peer verification. "Login::isLogged" reauthenticates using the attacker-settable "encoder_aVideoURL" cookie together with arbitrary nonempty "encoder_user" and "encoder_pass" cookies, and "Login::run" stores the raw fetched body in "result". The unauthenticated "objects/login.json.php" endpoint returns that session object, enabling full-response exfiltration through a supplied "siteURL"; its "Streamer::isURLAllowed" gate allows all sites when the operator allowlist is empty, the default. An unauthenticated remote attacker can read internal HTTP and HTTPS responses, including cloud instance-metadata credentials, and reach internal TCP services. A further pre-authentication FTP variant in "view/youtubeDl.json.php" routes an ftp "videoURL" into "FTPDownloader"; "parseFtpUrl" in "objects/FTPDownloader.php" accepts its host and port for "ftp_connect". This also enables requests to internal FTP services. Untrusted self-signed HTTPS certificates are accepted, and no account or operator interaction is required. Version 8.1.0 contains an initial remediation attempt that removes raw-response reflection and adds destination checks, but private-network exemptions and login TLS-verification defaults leave complete remediation of the described internal-network and TLS variants unresolved.