Skip to content
Threat Feed
Subscribe

Vendor

Wwbn

6 briefs RSS
high advisory

AVideo OS Command Injection via Unescaped m3u8 URL (CVE-2026-45578)

AVideo is vulnerable to OS command injection (CVE-2026-45578) in the `on_publish.php` file due to improper sanitization of the m3u8 URL, allowing attackers to execute arbitrary commands by injecting shell metacharacters.

AVideo command injection webserver
2r 1t
high advisory

AVideo Meet Plugin Authorization Bypass via Filename Parameter

AVideo's Meet plugin contains an authorization bypass vulnerability in the `uploadRecordedVideo.json.php` endpoint that derives `users_id` from the uploaded filename and calls passwordless `User->login()`, allowing any caller with the Meet shared secret to obtain a session as arbitrary users including admin.

AVideo authentication-bypass account-takeover web-application
2r 2t
high advisory

AVideo API Secret Disclosure Leads to Unauthorized Access

AVideo version 29.0 and earlier is vulnerable to unauthenticated API secret disclosure via a publicly accessible endpoint, allowing unauthorized access to protected API endpoints.

AVideo api-disclosure unauthorized-access
2r 1t
high advisory

AVideo SSRF Vulnerability via HTTP Redirect and DNS Rebinding

AVideo is vulnerable to Server-Side Request Forgery (SSRF) due to improper validation of user-supplied URLs that does not prevent HTTP redirects, and DNS rebinding due to discarded resolved IP addresses.

aVideo ssrf dns-rebinding
2r 1i
high advisory

AVideo CloneSite Unauthenticated Information Disclosure Leading to Remote Database Dump

AVideo is vulnerable to unauthenticated information disclosure via the `plugin/CloneSite/cloneClient.json.php` endpoint, which echoes the local CloneSite shared secret (`$objClone->myKey`) in HTTP responses without authentication, enabling cross-site database dumps of the configured clone server.

avideo information_disclosure database_dump
2r 2t
high advisory

AVideo Unauthenticated Cross-User JavaScript Execution via YPTSocket Vulnerability

AVideo is vulnerable to unauthenticated cross-site scripting (XSS) due to an incomplete server-side fix for a YPTSocket `autoEvalCodeOnHTML` eval sink, allowing an attacker to bypass the fix by nesting the payload under a top-level `json` field, leading to arbitrary JavaScript execution in any logged-in user's browser session.

AVideo xss websocket vulnerability
2r 2t