Avideo Encoder
Monthly
Unauthenticated remote attackers can drive AVideo-Encoder's privileged queue processor and read its control and status plane in default installations prior to 8.1.0. Because the application ships no global authentication layer (the bundled .htaccess denies only .git, *.log and avideo.log), the PHP endpoints view/run.php, view/queue.json.php, view/status.php and view/listFiles.json.php are directly reachable and perform their privileged actions for anonymous callers - invoking Encoder::run(), disclosing the job queue and every streamer site URL, returning host memory statistics with a wildcard Access-Control-Allow-Origin header, and enumerating media file names and paths in any directory readable by the web-server user. Impact is bounded to control-plane manipulation and information exposure (no code execution, and enumeration is limited to configured media extensions and does not return file contents); a public PoC reference with anonymous curl requests exists in the vendor advisory, but it is not verified as working exploit code and there is no KEV listing, with priority assessed as remediation this week and a vendor fix available in 8.1.0.
Unauthenticated server-side request forgery in AVideo-Encoder (WWBN / AVideo project) before the 8.1.0 remediation attempt lets anyone who can reach the encoder force it to fetch arbitrary URLs from its own network position, with the raw fetched body reflected back in the JSON login response - enough to harvest cloud instance-metadata credentials or probe internal HTTP, HTTPS, TCP and FTP services. No account or operator interaction is required because the only destination gate (Streamer::isURLAllowed) allows every target when the operator allowlist is empty, which is the default, and TLS peer verification is disabled so untrusted self-signed internal HTTPS endpoints are accepted. A public proof-of-concept reproduction (curl-based) is documented in the vendor security advisory; there is no confirmed active exploitation (not in CISA KEV). Version 8.1.0 is an initial remediation that removes raw-response reflection and adds destination checks, but private-network exemptions and the login TLS-verification default leave the internal-network and TLS variants unresolved.
Unauthenticated OS command injection in AVideo-Encoder before 8.1.0 gives remote attackers arbitrary command execution as the web-server user through the live-streaming endpoint view/videosListToLive.php. The endpoint requires only non-empty playlists_id and APISecret values, forwards APISecret without comparing it to any stored secret, and never applies the Streamer::isURLAllowed allowlist, so an attacker can point webSiteRootURL at an HTTP stub they control, have Login::run adopt the returned JSON as session state (self-granting isLogged and canStream), then return a video list whose videos[].path values are interpolated without escaping into ffprobe and ffmpeg commands run via exec. Successful exploitation discloses database and stored streamer credentials, permits upstream platform compromise, file modification and persistence as the web-server user, and can deny encoder service; the vendor fixed this in 8.1.0 and no public exploit code is confirmed in the supplied data, though the advisory includes a detailed working PoC recipe.
Unauthenticated PHP code injection in AVideo-Encoder before 8.1.0 allows a remote attacker to write arbitrary PHP into videos/configuration.php through install/checkConfiguration.php and execute it as the web-server user. The attack works only while videos/configuration.php is absent-the default on a fresh deployment or after the file is deleted or moved-and requires the attacker to supply a reachable database host, which they control, plus a systemRootPath containing index.php. Version 8.1.0 fixes the flaw; a public PoC reference exists and is not verified as working exploit code, and the decision label is act_now with CVSS 10.0.
Unauthenticated SQL injection in AVideo versions before 8.0 allows authenticated attackers to manipulate database queries through unsanitized sort parameters in POST requests, potentially leading to unauthorized data access or modification. The vulnerability stems from improper use of real_escape_string() on SQL identifiers rather than string literals, rendering the escaping mechanism ineffective. Affected organizations should upgrade to version 8.0 or implement WAF rules restricting sort parameter characters to alphanumeric and underscore values.
AVideo, a video-sharing platform, contains a Server-Side Request Forgery (SSRF) vulnerability in versions prior to 8.0 affecting the public thumbnail endpoints getImage.php and getImageMP4.php. Unauthenticated attackers can exploit insufficient URL validation to force the server to make requests to internal network resources including cloud metadata endpoints (AWS EC2 169.254.169.254), localhost, and private IP ranges. The vulnerability has a CVSS 4.0 score of 9.3 with network attack vector requiring no privileges or user interaction, though there is no evidence of active exploitation or public proof-of-concept at this time.
Unauthenticated OS command injection in AVideo before 7.0.
Reflected cross-site scripting in the AVideo-Encoder login interface (WWBN/AVideo project) affects all versions prior to 8.1.0 and is reachable by unauthenticated remote attackers because the login view renders for any anonymous visitor - the gate in view/index.php only checks Login::canUpload(). By persuading a victim operator to open a crafted login URL, an attacker can execute arbitrary JavaScript in the encoder's origin, read the operator session identifier exposed in inline script, capture credentials typed into the login form, and act as the operator against the encoder and its upstream AVideo platform. The vendor has released 8.1.0, the GitHub advisory includes reproduction payloads for the affected parameters, and no confirmed active exploitation is reported; the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (6.1), requiring victim interaction for scope-changed, low-confidentiality/low-integrity impact.
Unauthenticated remote attackers can drive AVideo-Encoder's privileged queue processor and read its control and status plane in default installations prior to 8.1.0. Because the application ships no global authentication layer (the bundled .htaccess denies only .git, *.log and avideo.log), the PHP endpoints view/run.php, view/queue.json.php, view/status.php and view/listFiles.json.php are directly reachable and perform their privileged actions for anonymous callers - invoking Encoder::run(), disclosing the job queue and every streamer site URL, returning host memory statistics with a wildcard Access-Control-Allow-Origin header, and enumerating media file names and paths in any directory readable by the web-server user. Impact is bounded to control-plane manipulation and information exposure (no code execution, and enumeration is limited to configured media extensions and does not return file contents); a public PoC reference with anonymous curl requests exists in the vendor advisory, but it is not verified as working exploit code and there is no KEV listing, with priority assessed as remediation this week and a vendor fix available in 8.1.0.
Unauthenticated server-side request forgery in AVideo-Encoder (WWBN / AVideo project) before the 8.1.0 remediation attempt lets anyone who can reach the encoder force it to fetch arbitrary URLs from its own network position, with the raw fetched body reflected back in the JSON login response - enough to harvest cloud instance-metadata credentials or probe internal HTTP, HTTPS, TCP and FTP services. No account or operator interaction is required because the only destination gate (Streamer::isURLAllowed) allows every target when the operator allowlist is empty, which is the default, and TLS peer verification is disabled so untrusted self-signed internal HTTPS endpoints are accepted. A public proof-of-concept reproduction (curl-based) is documented in the vendor security advisory; there is no confirmed active exploitation (not in CISA KEV). Version 8.1.0 is an initial remediation that removes raw-response reflection and adds destination checks, but private-network exemptions and the login TLS-verification default leave the internal-network and TLS variants unresolved.
Unauthenticated OS command injection in AVideo-Encoder before 8.1.0 gives remote attackers arbitrary command execution as the web-server user through the live-streaming endpoint view/videosListToLive.php. The endpoint requires only non-empty playlists_id and APISecret values, forwards APISecret without comparing it to any stored secret, and never applies the Streamer::isURLAllowed allowlist, so an attacker can point webSiteRootURL at an HTTP stub they control, have Login::run adopt the returned JSON as session state (self-granting isLogged and canStream), then return a video list whose videos[].path values are interpolated without escaping into ffprobe and ffmpeg commands run via exec. Successful exploitation discloses database and stored streamer credentials, permits upstream platform compromise, file modification and persistence as the web-server user, and can deny encoder service; the vendor fixed this in 8.1.0 and no public exploit code is confirmed in the supplied data, though the advisory includes a detailed working PoC recipe.
Unauthenticated PHP code injection in AVideo-Encoder before 8.1.0 allows a remote attacker to write arbitrary PHP into videos/configuration.php through install/checkConfiguration.php and execute it as the web-server user. The attack works only while videos/configuration.php is absent-the default on a fresh deployment or after the file is deleted or moved-and requires the attacker to supply a reachable database host, which they control, plus a systemRootPath containing index.php. Version 8.1.0 fixes the flaw; a public PoC reference exists and is not verified as working exploit code, and the decision label is act_now with CVSS 10.0.
Unauthenticated SQL injection in AVideo versions before 8.0 allows authenticated attackers to manipulate database queries through unsanitized sort parameters in POST requests, potentially leading to unauthorized data access or modification. The vulnerability stems from improper use of real_escape_string() on SQL identifiers rather than string literals, rendering the escaping mechanism ineffective. Affected organizations should upgrade to version 8.0 or implement WAF rules restricting sort parameter characters to alphanumeric and underscore values.
AVideo, a video-sharing platform, contains a Server-Side Request Forgery (SSRF) vulnerability in versions prior to 8.0 affecting the public thumbnail endpoints getImage.php and getImageMP4.php. Unauthenticated attackers can exploit insufficient URL validation to force the server to make requests to internal network resources including cloud metadata endpoints (AWS EC2 169.254.169.254), localhost, and private IP ranges. The vulnerability has a CVSS 4.0 score of 9.3 with network attack vector requiring no privileges or user interaction, though there is no evidence of active exploitation or public proof-of-concept at this time.
Unauthenticated OS command injection in AVideo before 7.0.
Reflected cross-site scripting in the AVideo-Encoder login interface (WWBN/AVideo project) affects all versions prior to 8.1.0 and is reachable by unauthenticated remote attackers because the login view renders for any anonymous visitor - the gate in view/index.php only checks Login::canUpload(). By persuading a victim operator to open a crafted login URL, an attacker can execute arbitrary JavaScript in the encoder's origin, read the operator session identifier exposed in inline script, capture credentials typed into the login form, and act as the operator against the encoder and its upstream AVideo platform. The vendor has released 8.1.0, the GitHub advisory includes reproduction payloads for the affected parameters, and no confirmed active exploitation is reported; the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (6.1), requiring victim interaction for scope-changed, low-confidentiality/low-integrity impact.