Wwbn

AVideo versions through 29.0 contain an OS command injection vulnerability, CVE-2026-63305, in the ffmpeg.json.php endpoint where unescaped notifyCode and callback parameters can be exploited by attackers crafting encrypted payloads to execute arbitrary OS commands as the web-server user, potentially leading to full system compromise.

AVideo versions up to and including 29.0 are vulnerable to an OS command injection (CVE-2026-63304) in the `listFFmpegProcesses()` function within `plugin/API/standAlone/functions.php`, allowing attackers to craft an encrypted `codeToExec` payload to bypass single-quote escaping and execute arbitrary operating system commands as the web-server user, leading to remote code execution.

AVideo is vulnerable to OS command injection (CVE-2026-45578) in the `on_publish.php` file due to improper sanitization of the m3u8 URL, allowing attackers to execute arbitrary commands by injecting shell metacharacters.

AVideo's Meet plugin contains an authorization bypass vulnerability in the `uploadRecordedVideo.json.php` endpoint that derives `users_id` from the uploaded filename and calls passwordless `User->login()`, allowing any caller with the Meet shared secret to obtain a session as arbitrary users including admin.

WWBN AVideo versions up to 26.0 are vulnerable to unauthenticated SQL injection via the RTMP `on_publish` callback, allowing attackers to extract sensitive database information.

WWBN AVideo platform versions up to 26.0 are vulnerable to privilege escalation via a CSRF vulnerability in the `plugin/Permissions/setPermission.json.php` endpoint, allowing an unauthenticated attacker to escalate privileges to near-admin access.

WWBN AVideo versions up to 26.0 are vulnerable to remote code execution, where an unauthenticated attacker can exploit a CSRF vulnerability in the `objects/pluginImport.json.php` endpoint to upload a malicious plugin containing a PHP webshell due to the application setting `session.cookie_samesite = 'None'`.

WWBN AVideo versions up to 26.0 are vulnerable to a denial-of-service attack where unauthenticated remote attackers can exhaust disk space by sending arbitrary POST data to a specific endpoint.

WWBN AVideo versions up to 26.0 are vulnerable to an arbitrary local file read via the `chunkFile` parameter in the `POST /objects/aVideoEncoder.json.php` endpoint, allowing authenticated users to read sensitive server files.

AVideo platform versions before 26.0 are vulnerable to unauthenticated SQL injection via the getAllCategories() method in objects/category.php due to insufficient sanitization of the doNotShowCats parameter, potentially leading to arbitrary code execution.

AVideo versions before 26.0 are vulnerable to an unauthenticated path traversal attack via the HLS streaming endpoint, allowing unauthorized access to private or paid videos by manipulating the `videoDirectory` GET parameter due to inconsistent path handling.

WWBN AVideo platform versions up to 26.0 generate weak 512-bit RSA keys for PGP 2FA, which can be easily factored to derive the private key and bypass the second authentication factor. Additionally, key generation endpoints lack authentication checks, exposing the system to resource exhaustion attacks.

WWBN AVideo versions 29.0 and below are vulnerable to cross-origin credentialed requests to API endpoints due to an incomplete CORS origin validation fix, potentially exposing sensitive user data.

AVideo versions 29.0 and prior are vulnerable to remote code execution due to unsanitized file path construction in the locale save endpoint, allowing arbitrary PHP file writes by authenticated administrators or those who can CSRF them.

AVideo versions 29.0 and prior contain a CSRF vulnerability in admin-only JSON endpoints, allowing attackers to perform unauthorized actions if they can lure a logged-in administrator to visit a malicious page.

WWBN AVideo versions 29.0 and below are vulnerable to Server-Side Request Forgery (SSRF) due to an insufficient hostname check in the `isSSRFSafeURL()` function, allowing attackers to reach arbitrary ports on the AVideo server and exfiltrate data.

WWBN AVideo versions before 26.0 are vulnerable to arbitrary file deletion due to insufficient sanitization of the `deleteDump` parameter in `plugin/CloneSite/cloneServer.json.php`, allowing attackers with clone credentials to delete critical files via path traversal.

Unauthenticated attackers can achieve remote code execution in WWBN AVideo versions up to 26.0 by chaining vulnerabilities in the CloneSite plugin related to exposed secrets, database dumps, and OS command injection.

AVideo version 29.0 and earlier is vulnerable to unauthenticated API secret disclosure via a publicly accessible endpoint, allowing unauthorized access to protected API endpoints.

WWBN AVideo versions 29.0 and below are vulnerable to cross-origin request attacks (CVE-2026-41056) due to improper handling of Origin headers and session cookies, allowing unauthorized access to user data and system modifications.

AVideo is vulnerable to unauthenticated information disclosure via the `plugin/CloneSite/cloneClient.json.php` endpoint, which echoes the local CloneSite shared secret (`$objClone->myKey`) in HTTP responses without authentication, enabling cross-site database dumps of the configured clone server.

WWBN AVideo version 29.0 and prior is vulnerable to unauthenticated arbitrary Javascript execution via the YPTSocket plugin, allowing an attacker to execute arbitrary code in the context of connected users, leading to account takeover and data theft.

WWBN AVideo versions prior to 26.0 are vulnerable to Server-Side Request Forgery (SSRF) via the `webSiteRootURL` parameter in `saveDVR.json.php`, allowing unauthenticated attackers to make arbitrary HTTP requests from the server.

WWBN AVideo is vulnerable to remote code execution due to a path traversal vulnerability in the `locale/save.php` endpoint, allowing an attacker to write arbitrary PHP files to any web-accessible directory via a maliciously crafted `flag` parameter, which can be exploited through CSRF.