Skip to content
Threat Feed
Subscribe

Product

AVideo

2 briefs RSS
high advisory

AVideo OS Command Injection via Unescaped m3u8 URL (CVE-2026-45578)

AVideo is vulnerable to OS command injection (CVE-2026-45578) in the `on_publish.php` file due to improper sanitization of the m3u8 URL, allowing attackers to execute arbitrary commands by injecting shell metacharacters.

AVideo command injection webserver
2r 1t
high advisory

AVideo Meet Plugin Authorization Bypass via Filename Parameter

AVideo's Meet plugin contains an authorization bypass vulnerability in the `uploadRecordedVideo.json.php` endpoint that derives `users_id` from the uploaded filename and calls passwordless `User->login()`, allowing any caller with the Meet shared secret to obtain a session as arbitrary users including admin.

AVideo authentication-bypass account-takeover web-application
2r 2t