Skip to content
Threat Feed

Tag

Information_disclosure

1 brief RSS
high advisory

AVideo CloneSite Unauthenticated Information Disclosure Leading to Remote Database Dump

AVideo is vulnerable to unauthenticated information disclosure via the `plugin/CloneSite/cloneClient.json.php` endpoint, which echoes the local CloneSite shared secret (`$objClone->myKey`) in HTTP responses without authentication, enabling cross-site database dumps of the configured clone server.

avideo information_disclosure database_dump
2r 2t