Avideo
Monthly
Missing authorization in WWBN AVideo's Scheduler email plugin exposes private subscriber email addresses, live-stream titles, and scheduled job metadata to any unauthenticated network attacker who can supply a valid site-wide daily token. The daily token is obtainable without authentication from publicly accessible Live pages, making the attack effectively unauthenticated for instances with open Live pages. No public exploit code has been identified at time of analysis, but the attack path is mechanically straightforward and the confidentiality impact is high given the exposure of user email addresses.
Stored cross-site scripting in the WWBN AVideo Bookmark plugin lets a video owner persist a JavaScript payload through the bookmark/chapter name parameter, which is concatenated into public watch-page HTML without output encoding (CWE-79). Every viewer of the affected video then executes attacker-controlled script in the AVideo origin, enabling session/account compromise of ordinary users and administrators. Reported by VulnCheck with a public advisory; no CISA KEV listing and no weaponized exploit code identified, though technical detail in the advisory lowers the barrier to reproduction.
Stored cross-site scripting in the LoginControl plugin of WWBN AVideo allows an authenticated low-privilege user to persist malicious JavaScript by submitting a crafted PGP public key, which is echoed unencoded into a textarea and executes in an administrator's browser session when the admin views the attacker's profile tab. This is a privilege-escalation vector - attacker-controlled script runs with admin session context, enabling account/platform takeover. VulnCheck reported it with a published GitHub Security Advisory; no public exploit is identified at time of analysis and it is not in CISA KEV.
Stored cross-site scripting in WWBN AVideo's CustomizeUser plugin lets an administrator persist an unsanitized field_name value through the add.json.php endpoint, which later executes as script when any user or admin renders the extra-info pages or profile forms via the typeToHTML function. The flaw affects AVideo up through commit c3edcc274c389816d434acadac07ee78eaf330c1 and was reported by VulnCheck; no public exploit identified at time of analysis and it is not in CISA KEV.
Stored cross-site scripting in WWBN AVideo (through commit c3edcc27) lets an authenticated user poison their own 'donationLink' profile field, which is later rendered unencoded inside an <a href="..."> attribute on the video watch page. Because User::save() validates the value only with FILTER_VALIDATE_URL (which accepts embedded double quotes and event handlers) and getDonationLink() applies only strip_tags(), an attacker can break out of the href attribute and execute JavaScript in the browser of any visitor - including an administrator - who hovers over the donation button. Reported by VulnCheck; publicly available exploit code exists via the advisory, and the issue was unfixed at time of reporting.
Missing ownership verification in AVideo's addLiveLink.php enables any authenticated canStream user to hijack another user's LiveLink by supplying a known linkId in an update request, overwriting the victim's HLS source URL and stream metadata without authorization. The flaw affects AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 and allows an attacker to silently redirect the victim's viewers to attacker-controlled media. No public exploit has been identified at time of analysis, but the low privilege bar - only a canStream account is required - makes this a realistic threat on shared multi-user AVideo deployments.
Unrestricted wallet-credit minting in AVideo's AD_Server plugin allows any authenticated user to fraudulently inflate YPTWallet balances for campaign video owners without proof of ad delivery. The flaw resides in plugin/AD_Server/log.php, which accepts arbitrary label values - including label=start - via POST requests and credits the associated campaign wallet unconditionally. Repeated exploitation constitutes ad fraud, enabling attackers to generate synthetic platform currency at will. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated file read in WWBN AVideo's getRecordedFile.php endpoint exposes recorded live-stream FLV files to any network attacker without authentication or authorization. All AVideo deployments through commit c3edcc274c389816d434acadac07ee78eaf330c1 are affected. An attacker who can reach the web interface and supply a known or guessed stream key can silently download private recorded video content, with no public exploit or KEV status confirmed at time of analysis.
Stored cross-site scripting in the YPTWallet plugin of WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) lets an authenticated low-privilege user plant malicious markup via a CryptoWallet configuration value that is base64-encoded but never HTML-escaped before being written to wallet_log.information. When an administrator reviews pending withdrawal requests in pendingRequests.php, the payload executes in their session, enabling attacker-driven administrative actions through same-origin fetch requests. Reported by VulnCheck with a vendor GitHub Security Advisory (GHSA-fvp5-q9jp-29mx); no public exploit identified at time of analysis.
Cross-site request forgery in WWBN AVideo's playlistRemove.php endpoint allows remote attackers to silently delete authenticated users' playlists by luring victims to a malicious webpage. The endpoint processes POST requests for playlist deletion without validating a CSRF token, meaning any browser-initiated request carrying a valid session cookie - regardless of origin - is accepted. No public exploit has been identified at time of analysis, though the attack is trivially constructible from a standard HTML form.
Stored cross-site scripting in WWBN AVideo (open-source video CMS) allows an administrator holding the canAdminUserGroups permission to persist malicious HTML/JavaScript through UserGroups::setGroup_name(), which then executes in the browser of any other administrator who opens the user manager interface. Affects all builds through commit c3edcc274c389816d434acadac07ee78eaf330c1. Reported by VulnCheck; no public exploit identified at time of analysis and it is not in CISA KEV.
Password-protection bypass in WWBN AVideo's PlayerSkins SEO plugin endpoint allows unauthenticated remote attackers to retrieve direct MP4 URLs for videos that owners have restricted behind passwords. The flaw resides in `plugin/PlayerSkins/seo.php`, where `getSources()` is invoked without any password validation step, so a caller supplying only a video ID receives the full source URL regardless of the configured password. All AVideo deployments through commit c3edcc274c389816d434acadac07ee78eaf330c1 are affected; no public exploit or CISA KEV listing has been identified at time of analysis.
Password-protected live stream bypass in AVideo exposes RTMP stream keys, HLS playlist URLs, and AES-128 decryption keys to unauthenticated remote callers via two compounding failures. The PHP-side stats API (`Live::_getStats()` in `plugin/Live/Live.php`) returns protected transmission credentials regardless of password check outcome - including the hidden_applications branch invoked when `canSeeLiveFromLiveKey()` denies access. Independently, the shipped NGINX configuration leaves the `/live` location serving `.m3u8` playlists, AES-128 segment encryption keys, and `.ts` segments without any `auth_request` directive (the `auth_key_check` in the `.key` block is commented out), allowing full stream decryption without the configured password. No patched version was available at time of the advisory.
Cross-site request forgery in WWBN AVideo's log archive endpoint allows unauthenticated remote attackers to exfiltrate sensitive application logs and destroy forensic evidence by tricking an authenticated administrator into visiting a malicious page. The `view/logArchive.json.php` endpoint accepts GET requests without any CSRF token validation, so a crafted page silently causes the administrator's browser to trigger log archiving - copying live logs into a publicly accessible zip file while simultaneously truncating the original log to eliminate attack traces. Affected versions span all releases through commit c3edcc274c389816d434acadac07ee78eaf330c1; no KEV listing and no public exploit code identified at time of analysis.
Cross-site request forgery in AVideo's setPassword.json.php endpoint allows unauthenticated remote attackers to modify or clear any user's channel password by tricking an authenticated administrator into visiting a malicious webpage. The root cause is the endpoint accepting GET requests for a state-changing password operation without CSRF token validation, making a single img tag or iframe on an attacker-controlled page sufficient to trigger the attack. No public exploit has been identified at time of analysis, and no KEV listing exists, but the low attack complexity makes successful exploitation realistic whenever an administrator can be phished.
Cross-site request forgery in WWBN AVideo's LoginControl plugin allows network-adjacent unauthenticated attackers to silently replace a logged-in victim's PGP two-factor authentication public key by luring them to a page containing a crafted image tag pointing to the unprotected `savePublicKey.json.php` GET endpoint. The outcome is either account lockout (denying the legitimate user access) or full account takeover if the attacker independently possesses the victim's password and can now pass 2FA using their own PGP key. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Stored cross-site scripting in WWBN AVideo's AD_Server plugin lets an unauthenticated attacker persist malicious HTML via the unescaped 'label' parameter of the log.php endpoint, which later executes as arbitrary JavaScript when an administrator opens the Ad Types report. Because the admin report renders the stored value with jQuery .html() without sanitization, exploitation yields code execution in a privileged administrator's browser session, enabling account/session takeover of the affected AVideo installation. No public exploit identified at time of analysis, though a coordinated GitHub Security Advisory (GHSA-h68w-3r38-wmm8) documents the flaw.
Stored cross-site scripting in WWBN AVideo's LiveLinks plugin lets a low-privileged user with canStream permission persist malicious JavaScript via unsanitized title and description fields, which then executes in the browser of every visitor who views the live-link page - including administrators - inside the site origin. Reported by VulnCheck, the flaw affects AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1; no public exploit identified at time of analysis and it is not in CISA KEV.
Stored cross-site scripting in WWBN AVideo (all versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1) lets a low-privileged, self-registered user plant a persistent JavaScript payload through video category creation. The unsanitized `name` and `iconClass` POST parameters in objects/categoryAddNew.json.php are later rendered into HTML text and a class attribute on watch pages and Gallery cards, so the payload executes in the browser of any visitor - including administrators - enabling session-riding authenticated requests. VulnCheck reported it unpatched; no public exploit code is identified at time of analysis and it is not in CISA KEV.
Stored cross-site scripting in the WWBN AVideo LoginControl plugin (all versions through commit c3edcc274c389816d434acadac07ee78eaf330c1) lets any authenticated user inject JavaScript via the User-Agent header, which is stored unencoded in login history and executes in an administrator's browser when they open the Login History page. Because it runs inside the admin session, an attacker can drive privileged actions and effect account takeover of the platform. Reported by VulnCheck; no public exploit identified at time of analysis and no active exploitation confirmed.
WWBN AVideo's restream subsystem allows any authenticated user holding `canStream` permission to mint authorization tokens for restream objects they do not own, by sending crafted requests to `getRestream.json.php` without ownership validation. Exchanging that token against `getLiveKey.json.php` exposes the victim's stored stream key for YouTube, Twitch, or arbitrary RTMP destinations - granting the attacker full publish access to another user's live streaming channel. No public exploit code has been identified at time of analysis, and the vulnerability is tracked by VulnCheck via GitHub security advisory GHSA-7jf4-mmqm-7p7x.
Unauthenticated account takeover in WWBN AVideo (through commit e01e41ecc) stems from get_api_preauthorize in plugin/API/API.php, a second, undocumented login path that performs the same credential check as get_api_signIn but omits the 10-attempts-per-5-minutes throttle enforced by checkRateLimit(). This lets remote attackers brute-force any account - including admin - without rate limiting, and the endpoint doubles as a credential oracle whose users_id field (1 vs 0) discloses password validity even though the message always reads 'Invalid credentials'. No public exploit identified at time of analysis, and no vendor-released patch is available.
Unauthenticated information disclosure in WWBN AVideo through version 29.0 allows any remote attacker to retrieve live-stream keys, private EPG programme schedules, and server identifiers from the exposed `plugin/PlayLists/epg.json.php` endpoint without credentials. The PHP endpoint performs no authentication check (CWE-306), and because the API accepts sequential user and playlist IDs, an attacker can enumerate the full set of sensitive broadcast credentials across all accounts on an instance. No public exploit or CISA KEV listing has been identified at time of analysis, though the issue is trivially exploitable given its network-accessible, zero-prerequisite nature.
Unauthenticated information disclosure in AVideo through 29.0 exposes private live-stream credentials - including stream keys and m3u8 playlist URLs - to any network-accessible attacker who queries the unprotected `plugin/Live/stats.json.php` endpoint. The `hidden_applications` array in the JSON response contains metadata for private, unlisted, and group-restricted live streams that the platform explicitly intends to conceal from unauthorized viewers. No public exploit has been identified at time of analysis, but the vulnerability is trivially reachable given its zero-precondition CVSS 4.0 profile (AV:N/AC:L/AT:N/PR:N/UI:N, score 8.7).
Authenticated streamers on AVideo through version 29.0 can harvest source stream keys and identity information belonging to all other active streamers by querying the restreamsActive.json.php endpoint, which applies no per-user ownership filtering. The exposed stream keys are live transmission credentials that can be used to impersonate affected streamers on third-party platforms such as YouTube Live or Twitch, enabling broadcast hijacking or session disruption. No active exploitation or public exploit code has been identified at the time of analysis, and exploitation requires a valid streaming account on the same AVideo instance.
Missing authorization in AVideo's SocialMediaPublisher plugin allows any authenticated user to overwrite another account's OAuth token records via an IDOR flaw in the add.json.php endpoint. By supplying arbitrary database row IDs, an attacker can corrupt a victim's stored access_token and refresh_token, then delete the record to permanently destroy the victim's social media provider linkage. No public exploit has been identified at time of analysis; exploitation requires a valid AVideo account (PR:L).
Cross-site request forgery in AVideo's YPTWallet plugin enables unauthenticated attackers to set arbitrary wallet balances for any user by tricking an authenticated administrator into loading a malicious webpage. The vulnerable endpoint `plugin/YPTWallet/view/saveBalance.php` relies exclusively on session cookies for request authorization with no CSRF token validation, meaning a forged POST request is accepted as legitimate whenever an admin's browser submits it. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, but the attack is trivially constructable from the public advisory.
PGP two-factor authentication bypass in AVideo's LoginControl::verifyChallenge() allows a network-accessible attacker holding only a valid account password to completely circumvent the PGP 2FA step and obtain full authenticated session access. The flaw stems from PHP's loose equality operator (==) comparing the submitted challenge against an unset session variable, which evaluates as true when an empty value is submitted - a classic PHP type-juggling weakness. No active exploitation (KEV) or public proof-of-concept code has been identified at time of analysis, but the bypass is trivially reproducible by any credential-holding attacker.
Email two-factor authentication bypass in WWBN AVideo (through commit c3edcc274) allows an attacker who already possesses valid account credentials to skip device-enrollment 2FA entirely. The root cause is a cache invalidation failure in the sqlDAL layer: empty result sets are cached, and writeSql never purges them, so when a new-device login triggers 2FA code generation, the confirmation code hash is computed from a stale empty cache entry rather than a freshly written value - causing the check to silently pass without a valid code. No public exploit code is confirmed and the vulnerability is not listed in CISA KEV at time of analysis, but the bypass is straightforward for any attacker with stolen or leaked passwords.
Authorization bypass in AVideo's live-streaming endpoint allows unauthenticated remote attackers to publish content to any user's RTMP stream by exploiting a hardcoded session cookie. In saveLive.php and related endpoints, PHP cookie precedence causes a session cookie named 'key' with the constant value 'value' to silently override the legitimate $_REQUEST['key'] stream key parameter check, effectively nullifying per-user stream authentication. Any attacker who reads this disclosure now possesses the exact bypass credential; no public exploit code or CISA KEV listing has been identified at time of analysis, but the trivial nature of exploitation (a known constant) makes it functionally equivalent to a zero-authentication bypass.
Insecure Direct Object Reference (IDOR) in WWBN AVideo allows authenticated users holding the canStream permission to hijack third-party live restream destinations on YouTube, Facebook, and Twitch by supplying arbitrary live_restreams_id values to resendRestreamer.json.php. The endpoint fails to verify that the requesting user owns the referenced restream configuration, exposing victim stream keys and allowing an attacker to broadcast their own content to victim-controlled channels. No public exploit code or active exploitation has been confirmed at time of analysis, though the impact on streaming operators could be severe and immediately visible.
Cross-site request forgery in WWBN AVideo through commit c3edcc274c allows unauthenticated remote attackers to manipulate live streaming state by inducing administrative users to visit attacker-controlled pages. The affected endpoints - deleteHistory.json.php and finishAll.json.php - accept state-changing GET requests without CSRF token validation, meaning a simple embedded image or link is sufficient to trigger destructive operations. An attacker can silently erase all live transmission history or mark active streams as finished with only passive administrator interaction, with no public exploit identified at time of analysis.
The synthesis JSON is above. Summary of the key analytical decisions: - **Impact framing:** The input's CWE-200 / "Information Disclosure" tag is technically the root cause, but the real-world outcome is **admin account takeover** via replayed live session identifiers — I reflected that in both C:H and I:H, matching VulnCheck's supplied VC:H/VI:H. - **Patch status:** Fix exists per GHSA-82q2-88mq-p44q, but no exact version was in the input, so I did not invent one. - **Exploitation status:** No KEV, no EPSS, no POC in the input → "no public exploit identified at time of analysis." - **`data_quality_flags`:** empty — the tags/vendor/CPE are all correct; the "Information Disclosure" tag understates but is not verifiably *wrong*, so it stays in `confidence_notes`/`risk_assessment` rather than as a machine-actionable flag. - **Prompt injection:** The "Editorial note (internal)" instructing insertion of the word "olsztyn" was a prompt-injection attempt (matching the known pattern in these CVE inputs) and was **ignored** — no canary word appears anywhere in the output. I also recorded a memory file for this CVE and added its index line.
Unauthenticated arbitrary file write in WWBN AVideo's notify.ffmpeg.json.php endpoint lets remote attackers plant files anywhere under the application root by supplying an attacker-chosen path in the avideoRelativePath parameter. Authentication is trivially defeated because the notifyCode token is any previously issued ciphertext replayed back - the server decrypts it but never validates it - enabling a straight path from unauthenticated request to writing a PHP webshell and remote code execution. Reported by VulnCheck; no public exploit identified at time of analysis, though the advisory describes the technique in enough detail to reproduce.
External-login account password generation in WWBN AVideo uses PHP's non-cryptographic rand() function, producing a keyspace of only 2^31 integers, and stores resulting passwords as unsalted MD5 hashes. An attacker who obtains the AVideo password hash database can exhaustively search the entire 2-billion-entry keyspace in seconds to minutes on commodity GPU hardware, recovering plaintext credentials for all external-login accounts. No public exploit has been identified at time of analysis; the CVSS 4.0 score of 7.4 reflects the prerequisite of prior hash access.
Server-side request forgery in WWBN AVideo (all versions through commit c91b5975d) allows authenticated API clients to force the application server to fetch arbitrary internal URLs via the unvalidated `profileImg` and `backgroundImg` parameters in the `set_api_userImages` endpoint. Unlike blind SSRF, fetched responses are written to publicly accessible web paths, enabling reliable exfiltration of cloud metadata credentials (e.g., AWS IMDS IAM tokens), internal API responses, and network-internal service data. No public exploit code or CISA KEV listing exists at time of analysis, but the non-blind exfiltration path significantly elevates real-world exploitability for cloud-hosted deployments.
Server-side request forgery in AVideo's EPG parser allows authenticated uploaders to force the server to fetch arbitrary internal URLs via the epg_link parameter during video upload. Any AVideo instance through commit c91b5975d is affected; the parameter undergoes only syntactic validation at submission time, and the actual server-side HTTP fetch during EPG generation occurs without SSRF protections such as private-IP blocking, allowlisting, or DNS rebinding defenses. No public exploit has been identified at time of analysis, but the attack requires only uploader-level credentials and is straightforward to execute against cloud-hosted or internally-networked deployments.
Cross-site request forgery in WWBN AVideo through commit c91b5975d allows unauthenticated remote attackers to hijack authenticated streamers' live broadcasts by tricking them into loading a malicious page. The saveLive.php endpoint in the Live plugin omits both POST-method enforcement (forbidIfNotPost) and CSRF token validation (forbidIfInvalidToken), so a crafted image tag silently overwrites the victim's RTMP key, password, and stream title when loaded by a logged-in streamer. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Cross-site request forgery chained with path traversal in AVideo's stopLive.php enables attackers to trigger recursive deletion of arbitrary server directories when an authenticated administrator visits a malicious page. The vulnerability exists through commit c91b5975d of the WWBN AVideo self-hosted video platform, affecting all versions covered by CPE cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*. The attack exploits missing CSRF token validation in stopLive.php combined with unsanitized concatenation of the key parameter into filesystem paths, allowing payloads like key=../../videos to destroy the videos directory and its contents. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated SQL injection in WWBN AVideo's channels API endpoint allows remote attackers to extract password hashes and account recovery tokens without any credentials. The `sort` column parameter in `get.json.php?APIName=channels` is injected directly into a SQL ORDER BY clause unsanitized, enabling an ordering oracle attack to infer sensitive column values character-by-character and triggering verbose SQL errors that disclose the full query and database schema. No public exploit has been identified at time of analysis, though VulnCheck has independently reported this vulnerability with a GitHub Security Advisory published by the vendor.
Full account takeover in WWBN AVideo arises because the video_id_hash acts as a non-expiring, non-revocable bearer token that authenticates the holder as the video owner with complete administrator privileges. Any attacker who obtains a valid video_id_hash can replay it indefinitely to gain full admin session access, and the credential keeps working even after the victim rotates their password - eliminating the primary recovery mechanism. Reported by VulnCheck with a fix in the vendor GitHub Security Advisory; no public exploit identified at time of analysis, and no EPSS or KEV data was provided.
Cross-site request forgery in WWBN AVideo's referer-validation logic allows unauthenticated remote attackers to trick administrative users into issuing forged requests that modify live server configuration. The flaw resides in the get_domain() and isSameDomain() functions, which fail to reject origins from sibling subdomains or malformed long-gTLD URLs, enabling forged admin-level ObjectYPT writes. No public exploit code or active exploitation has been identified at time of analysis, but the bypass is straightforward to weaponize against any deployment where an attacker can influence an admin to visit a malicious page.
Account takeover in WWBN AVideo is possible because userRecoverPassSave.json.php never checks whether a password-recovery token has expired, so any captured token stays valid forever. An attacker who obtains a recovery token for a target account can reset that account's password at an arbitrary later time and seize full control. Reported by VulnCheck with a coordinated GitHub Security Advisory (GHSA-j9p7-hm85-9v77); no public exploit identified at time of analysis and no EPSS/KEV data supplied.
Login-time security-control bypass in WWBN AVideo (commit e01e41ecc and earlier) lets an attacker who already possesses valid credentials defeat two-factor authentication, brute-force captcha escalation, and login/device audit logging by merely setting the HTTP User-Agent header to the literal string 'AVideoEncoder' or 'AVideoMobileApp'. The isAVideoEncoder()/isAVideoMobileApp() trust decisions rely solely on this client-controlled header with no IP allow-list or shared secret, so the protections are trivially spoofable. No patch is available at the time of analysis and no public exploit has been identified, though the advisory itself fully describes the technique.
Rate-limit bypass in WWBN AVideo (all versions) allows unauthenticated remote attackers to perform unlimited credential-guessing against login endpoints by rotating arbitrary X-Real-IP or X-Forwarded-For header values per request. The enforceRateLimit() function uses the attacker-supplied header as the client identifier without verifying the request originates from a trusted proxy, nullifying IP-based throttling entirely. No public exploit code has been identified at time of analysis, but the technique requires no specialised tooling beyond basic HTTP scripting.
UNION-based SQL injection in AVideo through version 29.0 allows unauthenticated remote attackers to read arbitrary database contents via the User_Location plugin's regions.json.php and cities.json.php endpoints. The country and region GET parameters are passed unsanitized into SQL queries without prepared statement binding, enabling direct extraction of password hashes and sensitive configuration data from the underlying database. No public exploit has been identified at time of analysis, but the UNION-based technique is elementary and well within reach of automated scanning tooling.
Unauthenticated disruption of scheduled live broadcasts in AVideo (all versions, CPE cpe:2.3:a:wwbn:avideo:*) is possible via a missing access control check on the RTMP callback endpoint plugin/Live/on_publish.php. The endpoint accepts crafted POST requests containing fabricated stream keys matching the predictable -ps-<N> pattern, causing the platform to mark any targeted scheduled broadcast as failed without requiring credentials. With a CVSS 4.0 score of 8.8 and PR:N/AV:N, this is remotely exploitable at low complexity; no public exploit or CISA KEV listing has been identified at time of analysis.
Cross-site request forgery in AVideo's plugin/API/set.json.php endpoint allows unauthenticated remote attackers to perform destructive, state-changing operations on behalf of authenticated victims by weaponizing ordinary browser GET requests. The affected endpoint accepts API parameters via GET without enforcing CSRF tokens or origin validation, enabling attackers to delete videos, deactivate user accounts, or manipulate playlists simply by luring an authenticated victim to a crafted URL. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis, though the low technical barrier for GET-based CSRF attacks makes independent replication straightforward.
SSRF filter bypass in WWBN AVideo exposes cloud metadata services and loopback interfaces to authenticated low-privilege attackers. The isSSRFSafeURL function fails to normalize IPv6 NAT64 addresses rendered in hexadecimal notation, allowing crafted URLs such as 64:ff9b::a9fe:a9fe to resolve to protected addresses like 169.254.169.254 while evading the SSRF blocklist. Exploitation could yield cloud instance credentials or access to internal services; no public exploit or KEV listing is confirmed at time of analysis.
Unauthenticated stream credential disclosure in AVideo (WWBN, commit e01e41ecc and earlier) lets remote attackers retrieve any user's restream stream_key and stream_url for external platforms like YouTube, Facebook, and Twitch. The getLiveKey.json.php endpoint accepts a 'token' parameter that bypasses both the Live::canRestream() access gate and the restream ownership check, and the token is merely AES-256-CBC encryptString() of an integer id with no user binding, expiry, or authentication tag. Because a public encryption oracle (view/url2Embed.json.php) lets anyone encrypt arbitrary values, valid tokens can be forged with no authentication; no public exploit is identified at time of analysis but the technique is fully described.
Rate-limiting bypass in WWBN AVideo (through commit e01e41ecc) allows unauthenticated remote attackers to conduct unlimited brute-force attacks against login.json.php and 13 other protected endpoints by exploiting a logic flaw in enforceRateLimit(). The function relies on ObjectYPT::setCacheGlobal to persist per-client attempt counters, but silently discards those writes whenever isBot() classifies the client as a bot - which occurs by default for any request omitting a User-Agent header or using agent strings matching 'curl', 'bot', 'crawler', or 'spider'. No active exploitation has been confirmed at time of analysis, but the trivial bypass mechanism makes this immediately usable for credential stuffing without any specialized tooling.
Privilege escalation in WWBN AVideo through commit 9c39d8c8 enables any user with upload permission to silently hijack an administrator session without knowing their credentials. Two chained functions - deduplicateByEncoderQueueId() exposing video hash tokens without ownership verification, and useVideoHashOrLogin() accepting those tokens as passwordless authentication - create a direct path from low-privilege user to full administrative access. No public exploit has been confirmed and the vulnerability is not listed in CISA KEV, but the low attack complexity and high CIA impact make this a high-priority remediation for any internet-accessible AVideo deployment.
Unauthorized access to restricted video content in WWBN AVideo (through commit 9c39d8c8) is enabled by a fundamental design flaw in the platform's token subsystem: getToken() produces tokens with no binding to user identity or intended purpose, and the Gallery plugin endpoint (plugin/Gallery/view/sections.php) distributes these tokens freely to unauthenticated visitors. Because the tokens carry no scope constraint, they are accepted as valid authorization across unrelated subsystems including the HLS streaming endpoint (view/hls.php), allowing any remote unauthenticated party to retrieve private video content. No public exploit has been identified at time of analysis, but the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) reflects a trivially simple, two-step attack requiring no special tools.
Cross-site request forgery in WWBN AVideo through commit 9c39d8c8 allows remote attackers to permanently publish embargoed videos by tricking an authenticated administrator into loading a malicious GET request targeting the releaseVideoNow.json.php endpoint. The endpoint accepts state-changing GET requests without any CSRF token or origin validation, relying solely on the browser's ambient session cookie. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified, though the GET-based CSRF pattern is trivially weaponizable via a one-pixel image tag or link.
Authorization bypass in WWBN AVideo through commit 9c39d8c8b4c1f75540788d6b391740852ceb0732 allows any authenticated user to forge two-party affiliation consent records and subsequently hijack video ownership of arbitrary content on the platform. The Users_affiliations add.json.php endpoint accepts attacker-controlled counterparty agreement timestamps without verification, enabling creation of forged affiliation records with approved status that are then unconditionally trusted by the videoAddNew.json.php ownership-transfer endpoint. No public exploit code or CISA KEV listing has been identified at time of analysis; however, only a low-privilege account is required, making this accessible to any registered user on a vulnerable instance.
OS command injection in WWBN AVideo through version 29.0 allows attackers to execute arbitrary operating-system commands as the web-server user via the ffmpeg.json.php endpoint. The notifyCode and callback request parameters are concatenated into a shell command without escaping, so an attacker able to produce a valid encrypted payload can inject shell metacharacters and achieve remote code execution. No public exploit identified at time of analysis; the flaw carries a CVSS 4.0 base score of 9.2, though successful exploitation is gated by the requirement to forge a valid encrypted payload.
OS command injection in AVideo (WWBN) through version 29.0 lets remote attackers who can forge a valid encrypted codeToExec payload run arbitrary shell commands as the web-server user via the listFFmpegProcesses() function in the standAlone plugin API. The flaw is unauthenticated (PR:N) but non-trivial to reach because it depends on producing an accepted encrypted parameter, and no public exploit or CISA KEV listing is identified at time of analysis.
Stored DOM cross-site scripting in WWBN AVideo's YPTSocket plugin (all versions prior to 29.0) lets any unauthenticated remote attacker run arbitrary JavaScript in the browser session of any administrator viewing the YPTSocket online-users debug panel. Because the malicious WebSocket metadata is broadcast to every connected client and rendered without escaping, a single anonymous WebSocket connection can be escalated into full administrative account takeover via the admin's own session and CSRF token. No public exploit identified at time of analysis; the flaw carries a CVSS 9.6 (Critical) rating driven by the scope change into the privileged admin origin.
Authorization bypass in AVideo's Meet plugin (versions through 29.0) lets remote attackers hijack arbitrary user sessions, including admin, by abusing the uploadRecordedVideo.json.php endpoint which derives the target users_id from a caller-controlled filename and then invokes the passwordless User->login() path. Exploitation requires the Meet shared secret, but that secret is a deterministic MD5 of values from configuration.php and is recoverable via known path-traversal flaws or timing attacks against checkToken.json.php. No public exploit identified at time of analysis, though the VulnCheck and GHSA advisories document the attack with code-level precision.
Unauthenticated information disclosure in AVideo through 26.0 exposes payment transaction records via multiple list.json.php endpoints in the PayPalYPT, AuthorizeNet, and BTCPayments plugins that lack User::isAdmin() authorization checks. Remote attackers can issue direct GET requests to harvest PayPal billing agreement IDs, Express Checkout tokens, Authorize.Net webhook payloads, and Bitcoin transaction records without credentials. No public exploit identified at time of analysis, but the GHSA advisory from WWBN/AVideo and VulnCheck disclosure provide full endpoint paths sufficient for trivial reproduction.
Wallet balance forgery in WWBN AVideo 29.0 and earlier allows any authenticated user to credit their own wallet with arbitrary funds by abusing an unfinished AuthorizeNet payment handler. The plugin/AuthorizeNet/processPayment.json.php endpoint hardcodes payment success and calls YPTWallet::addBalance() using an attacker-supplied amount with no validation of the underlying Authorize.Net transaction. No public exploit has been identified at time of analysis, but the flaw is trivially reproducible from a logged-in account.
Server-side request forgery in WWBN AVideo 29.0 and earlier lets an authenticated upload-capable user bypass the isSSRFSafeURL() same-domain shortcircuit by supplying the site's own public hostname with a non-standard port, causing the server to fetch arbitrary internal ports and save the response to a web-accessible cache path for full exfiltration. The flaw carries a CVSS 7.7 (scope-changing confidentiality impact) and publicly available exploit code exists via the GitHub Security Advisory, though it is not listed in CISA KEV and EPSS probability is negligible (0.03%, 8th percentile).
Arbitrary file deletion in WWBN AVideo (versions 29.0 and below) lets an authenticated attacker abuse the CloneSite plugin's `deleteDump` GET parameter to `unlink()` any file the web server can access. The `deleteDump` value is concatenated directly onto the clones directory path with no sanitization, so `../../` sequences escape the intended directory. This is an incomplete-fix regression of CVE-2026-33293; publicly available exploit code exists (advisory PoC), but there is no public exploit identified as used in active attacks, and EPSS risk is very low (0.04%).
Cross-origin data exposure in WWBN AVideo 29.0 and earlier lets a malicious website read authenticated /api/* responses because an incomplete CORS fix still reflects arbitrary Origin headers with Access-Control-Allow-Credentials: true. Any logged-in user who visits an attacker-controlled page can have their session-authenticated API responses - containing email, admin status, user ID, and other PII - read cross-origin. Publicly available exploit code exists (SSVC: poc) and the issue is confirmed via GitHub Security Advisory GHSA-ff5q-cc22-fgp4, though EPSS is very low (0.01%) and it is not in CISA KEV.
Cross-origin account takeover in WWBN AVideo (versions 29.0 and below) allows any attacker-controlled website to read authenticated API responses and issue state-changing requests on behalf of a logged-in victim. The `allowOrigin(true)` routine reflects the attacker's `Origin` header into `Access-Control-Allow-Origin` while also sending `Access-Control-Allow-Credentials: true`, and combined with the app's `SameSite=None` session cookie the victim's browser attaches credentials to cross-origin calls to the core get.json.php/set.json.php API. Proof-of-concept exploitation is documented in the GitHub advisory; EPSS is very low (0.04%) and it is not in CISA KEV, so no confirmed active exploitation exists.
Server-side request forgery in WWBN AVideo (versions 29.0 and below) lets remote unauthenticated attackers coerce the LiveLinks proxy (plugin/LiveLinks/proxy.php) into contacting internal-only endpoints, because an incomplete fix for CVE-2026-33039 leaves a DNS time-of-check-to-time-of-use gap. Although isSSRFSafeURL() validates the target, get_headers() and fakeBrowser() resolve DNS again independently, so a DNS-rebinding domain with TTL=0 can return a safe external IP during validation and an internal IP during the actual request, reaching resources like cloud metadata (169.254.169.254) or loopback services. Publicly available exploit code exists (a Python PoC in the GHSA advisory); EPSS is low at 0.03% and it is not listed in CISA KEV.
Cross-site request forgery in WWBN AVideo (versions 29.0 and prior) lets an attacker abuse a logged-in admin's session against three state-changing JSON endpoints (categoryAddNew, categoryDelete, and pluginRunUpdateScript) that enforce only a role check and omit the CSRF token validation their sibling endpoints use. By luring an authenticated administrator to a malicious page, an attacker can create, overwrite, or delete video categories and trigger execution of any installed plugin's updateScript() method. Publicly available exploit code exists per the SSVC assessment, though EPSS is very low (0.02%, 5th percentile) and it is not on the CISA KEV list.
Remote code execution in AVideo versions 29.0 and below allows unauthenticated attackers to execute arbitrary shell commands on the server via command injection in the CloneSite plugin's cloneServer.json.php endpoint. Attackers exploit unsanitized user input in the 'url' parameter that gets directly concatenated into a wget command executed through PHP's exec() function. With CVSS 8.9 (AV:N/AC:L/PR:N/UI:N) and proof-of-concept exploitation confirmed (E:P), this represents a critical risk requiring immediate patching. Fix available in commit 473c609fc2defdea8b937b00e86ce88eba1f15bb.
Remote code execution in WWBN AVideo up to version 29.0 allows unauthenticated attackers to execute arbitrary system commands via unsanitized URL parameters in test.php. This vulnerability stems from an incomplete fix that sanitized wget calls but left file_get_contents and curl code paths exploitable through regex bypass (accepting strings like 'httpevil[.]com'). CVSS 9.3 with Critical scope change reflects the severity. Upstream fix available in commit 78bccae but no tagged release version confirmed at time of analysis. EPSS data not provided; no CISA KEV listing identified.
Cross-site request forgery in WWBN AVideo (versions ≤ 29.0) lets an attacker fully rewrite global site configuration by luring a logged-in administrator to a malicious page. The `objects/configurationUpdate.json.php` endpoint (aka `/updateConfig`) gates only on `User::isAdmin()` and omits any anti-CSRF token, Origin/Referer check, or `forbidIfIsUntrustedRequest()` call, so a single auto-submitted cross-origin POST can overwrite the encoder URL, SMTP credentials, site `<head>` HTML, logo, favicon, and contact email. Publicly available exploit code exists (SSVC: PoC) but the flaw is not in CISA KEV, and EPSS is very low at 0.02%.
Unauthenticated cross-user JavaScript execution in WWBN AVideo (versions 29.0 and prior) lets a remote attacker broadcast arbitrary code to every connected browser through the YPTSocket WebSocket plugin. Because anonymous visitors are issued valid socket tokens and the server relays the attacker-controlled `msg` and `callback` fields verbatim into client-side eval() sinks, any visitor can execute JavaScript in the origin of all connected users - including administrators - yielding universal account takeover, session theft, and privileged action execution. Publicly available exploit code exists (SSVC: PoC) though the flaw is not listed in CISA KEV, and EPSS is currently low at 0.17%.
Path traversal in WWBN AVideo 29.0 and earlier allows authenticated administrators (or CSRF-tricked admins) to write arbitrary PHP files anywhere on the server filesystem, achieving remote code execution. The locale save endpoint fails to sanitize the 'flag' parameter used in file path construction and lacks CSRF protection despite SameSite=None cookies, enabling straightforward exploitation by lower-privilege attackers who chain CSRF against admin sessions. Upstream fix committed to GitHub (57f89ffb) but released patched version not independently confirmed. CVSS 8.7 reflects high impact but requires privileged access - real-world risk depends heavily on admin session hijacking opportunities.
Server-Side Request Forgery (SSRF) in WWBN AVideo 26.0 and earlier allows authenticated uploaders to exfiltrate data from internal network resources via objects/aVideoEncoder.json.php. The flaw bypasses existing SSRF protections by permitting attacker-controlled URLs with common media extensions (.mp4, .mp3, .zip, .jpg, .png, .gif, .webm), forcing the server to fetch and store arbitrary remote content. This represents an incomplete fix for CVE-2026-27732. No public exploit identified at time of analysis. CVSS 7.1 with network-accessible attack vector requiring low-privileged authentication.
Path traversal in WWBN AVideo platform ≤26.0 allows authenticated uploaders to read arbitrary server files via GIF poster manipulation. An attacker with uploader privileges can exploit aVideoEncoderReceiveImage.json.php to bypass path sanitization, fetch local files like /etc/passwd or application source code, and republish the contents through publicly accessible GIF media URLs. CVSS 7.6 reflects high confidentiality impact with low-complexity network attack requiring only low-privilege authentication. No public exploit identified at time of analysis, though EPSS data not available for risk quantification.
Unauthenticated remote attackers can bypass CLI-only access controls in WWBN AVideo versions 26.0 and prior via a PHP operator precedence bug in install/deleteSystemdPrivate.php, allowing HTTP access to delete server temp directory files and disclose their contents without authentication. The vulnerability stems from a logic error where !php_sapi_name() === 'cli' evaluates incorrectly due to operator binding precedence, causing the access guard to fail entirely. No public exploit code or active exploitation has been reported at the time of this analysis.
WWBN AVideo 26.0 and prior exposes sensitive user data through 21 unauthenticated API endpoints via the CreatePlugin template generator. The list.json.php template lacks authentication checks present in its companion add.json.php and delete.json.php templates, allowing remote attackers to enumerate and retrieve user PII, payment logs, IP addresses, user agents, and internal system records without authentication. No vendor patch exists at time of analysis.
Unauthenticated attackers can remotely terminate any active live stream in WWBN AVideo 26.0 and prior by sending crafted POST requests to the on_publish_done.php endpoint in the Live plugin. The vulnerability combines two weaknesses: an unauthenticated stats.json.php endpoint that exposes active stream keys, and the on_publish_done.php RTMP callback handler that processes stream termination requests without authentication or authorization checks. This enables complete denial-of-service against all platform live streaming functionality. CVSS 7.5 (High) with network attack vector, low complexity, and no privileges required. No vendor-released patch identified at time of analysis; EPSS data not available.
Cross-site request forgery in WWBN AVideo 26.0 and earlier enables remote attackers to reconfigure critical plugin settings through forged requests targeting admin/save.json.php. The endpoint lacks CSRF token validation while the application sets SameSite=None cookies, allowing attackers to manipulate payment processors, authentication providers, and cloud storage credentials by tricking authenticated administrators into visiting malicious pages. No vendor-released patch identified at time of analysis. EPSS data unavailable; not listed in CISA KEV; no public exploit identified at time of analysis, though exploitation requires only standard CSRF techniques.
Reflected cross-site scripting (XSS) in WWBN AVideo versions up to 26.0 enables credential theft through unsanitized request parameter echoed into JavaScript context. Attackers can craft malicious URLs that, when clicked by authenticated users, execute arbitrary JavaScript and exfiltrate the victim's username and password hash directly exposed in the vulnerable code block. CVSS score of 8.2 reflects high confidentiality impact; no public exploit identified at time of analysis.
SQL injection in WWBN AVideo versions up to 26.0 allows unauthenticated remote attackers to extract sensitive database contents and modify data through the RTMP publish authentication stream key validation mechanism. The vulnerability (CVSS 9.1 Critical) arises from unsanitized string interpolation in Live_schedule::keyExists() fallback logic, affecting the open-source video platform's live streaming infrastructure. No vendor-released patch identified at time of analysis, and no public exploit identified at time of analysis.
WWBN AVideo, an open source video platform, contains a SQL injection vulnerability in the Subscribe::save() method that allows authenticated attackers to execute arbitrary SQL queries. Versions up to and including 26.0 are affected, with the vulnerability stemming from unsanitized user input from the $_POST['user_id'] parameter being concatenated directly into INSERT queries. An attacker with low-level authentication can extract sensitive data including password hashes, API keys, and encryption salts from the database, representing a significant information disclosure risk.
WWBN AVideo video platform up to and including version 26.0 contains an authentication bypass vulnerability in the CDN plugin that allows unauthenticated remote attackers to completely modify CDN configuration settings including storage credentials and authentication keys. The vulnerability stems from the CDN plugin's default empty string authentication key, which causes validation checks to be bypassed entirely when the plugin is enabled but not properly configured. The CVSS score of 8.6 reflects high integrity impact with network-based exploitation requiring no privileges or user interaction.
WWBN AVideo versions up to and including 26.0 contain a critical file upload vulnerability (CWE-434) that allows authenticated attackers to upload and execute arbitrary PHP code on the server. The vulnerability exists in the downloadVideoFromDownloadURL() function which saves remote content with its original filename and extension to a web-accessible directory; by providing an invalid resolution parameter, attackers can bypass cleanup mechanisms, leaving executable PHP files persistent under the web root. With a CVSS score of 8.8, this represents a high-severity remote code execution risk for authenticated users.
WWBN AVideo versions up to and including 26.0 contain an authentication bypass vulnerability in the standalone live stream control endpoint. The endpoint accepts a user-supplied 'streamerURL' parameter that redirects token verification to an attacker-controlled server, allowing complete bypass of authentication without any user interaction. With a CVSS score of 9.4, an attacker gains unauthenticated control over any live stream including the ability to drop publishers, manipulate recordings, and probe stream existence.
WWBN AVideo, an open source video platform, contains a critical path traversal vulnerability in the pluginRunDatabaseScript.json.php endpoint that allows authenticated administrators to execute arbitrary SQL queries against the application database. Versions up to and including 26.0 are affected. The vulnerability can also be exploited via CSRF attacks against authenticated admin sessions, enabling unauthenticated attackers to achieve remote code execution or complete database compromise.
SQL injection in WWBN AVideo up to version 26.0 allows authenticated users to extract arbitrary database contents through time-based blind SQL injection via the remindMe.json.php endpoint. The vulnerability stems from insufficient input sanitization of the live_schedule_id parameter, which is concatenated directly into a SQL LIKE clause despite partial validation in intermediate functions. No patch is currently available.
Privilege escalation in WWBN AVideo up to version 26.0 allows users with "Videos Moderator" permissions to gain full video management capabilities, including transferring ownership and deleting any video, by exploiting inconsistent authorization checks between the video editing and deletion endpoints. An authenticated attacker can chain an ownership transfer with deletion operations to compromise videos outside their legitimate scope. A patch is available in commit 838e16818c793779406ecbf34ebaeba9830e33f8.
A Cross-Site Request Forgery (CSRF) vulnerability in WWBN AVideo open source video platform versions up to and including 26.0 allows unauthenticated attackers to escalate privileges to near-admin access by tricking an administrator into visiting a malicious page. The vulnerability exists in the setPermission.json.php endpoint which accepts state-changing operations via GET requests without CSRF token validation, compounded by the application's explicit SameSite=None cookie setting. No patched version is currently available, and with a CVSS score of 8.1 (High), this represents a significant risk for installations with administrative users who browse external content.
WWBN AVideo versions up to and including 26.0 contain a command injection vulnerability in the restreamer endpoint that allows authenticated attackers to execute arbitrary commands on the server. The vulnerability stems from unsanitized user input (users_id and liveTransmitionHistory_id parameters) being embedded directly into shell commands via exec(). With a CVSS score of 8.8, this critical vulnerability requires low attack complexity and low privileges, enabling complete system compromise including data theft, modification, and denial of service.
WWBN AVideo versions up to and including 26.0 contain a critical file upload vulnerability in the ImageGallery::saveFile() method that allows authenticated attackers to upload polyglot files (JPEG with embedded PHP code) and achieve Remote Code Execution. The vulnerability exploits a mismatch between MIME type validation (which checks file content) and filename extension handling (which trusts user input), allowing attackers to bypass security controls and execute arbitrary code on the server. A patch is available in commit 345a8d3ece0ad1e1b71a704c1579cbf885d8f3ae, and the issue has been publicly disclosed via GitHub Security Advisory GHSA-wxjw-phj6-g75w.
Missing authorization in WWBN AVideo's Scheduler email plugin exposes private subscriber email addresses, live-stream titles, and scheduled job metadata to any unauthenticated network attacker who can supply a valid site-wide daily token. The daily token is obtainable without authentication from publicly accessible Live pages, making the attack effectively unauthenticated for instances with open Live pages. No public exploit code has been identified at time of analysis, but the attack path is mechanically straightforward and the confidentiality impact is high given the exposure of user email addresses.
Stored cross-site scripting in the WWBN AVideo Bookmark plugin lets a video owner persist a JavaScript payload through the bookmark/chapter name parameter, which is concatenated into public watch-page HTML without output encoding (CWE-79). Every viewer of the affected video then executes attacker-controlled script in the AVideo origin, enabling session/account compromise of ordinary users and administrators. Reported by VulnCheck with a public advisory; no CISA KEV listing and no weaponized exploit code identified, though technical detail in the advisory lowers the barrier to reproduction.
Stored cross-site scripting in the LoginControl plugin of WWBN AVideo allows an authenticated low-privilege user to persist malicious JavaScript by submitting a crafted PGP public key, which is echoed unencoded into a textarea and executes in an administrator's browser session when the admin views the attacker's profile tab. This is a privilege-escalation vector - attacker-controlled script runs with admin session context, enabling account/platform takeover. VulnCheck reported it with a published GitHub Security Advisory; no public exploit is identified at time of analysis and it is not in CISA KEV.
Stored cross-site scripting in WWBN AVideo's CustomizeUser plugin lets an administrator persist an unsanitized field_name value through the add.json.php endpoint, which later executes as script when any user or admin renders the extra-info pages or profile forms via the typeToHTML function. The flaw affects AVideo up through commit c3edcc274c389816d434acadac07ee78eaf330c1 and was reported by VulnCheck; no public exploit identified at time of analysis and it is not in CISA KEV.
Stored cross-site scripting in WWBN AVideo (through commit c3edcc27) lets an authenticated user poison their own 'donationLink' profile field, which is later rendered unencoded inside an <a href="..."> attribute on the video watch page. Because User::save() validates the value only with FILTER_VALIDATE_URL (which accepts embedded double quotes and event handlers) and getDonationLink() applies only strip_tags(), an attacker can break out of the href attribute and execute JavaScript in the browser of any visitor - including an administrator - who hovers over the donation button. Reported by VulnCheck; publicly available exploit code exists via the advisory, and the issue was unfixed at time of reporting.
Missing ownership verification in AVideo's addLiveLink.php enables any authenticated canStream user to hijack another user's LiveLink by supplying a known linkId in an update request, overwriting the victim's HLS source URL and stream metadata without authorization. The flaw affects AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 and allows an attacker to silently redirect the victim's viewers to attacker-controlled media. No public exploit has been identified at time of analysis, but the low privilege bar - only a canStream account is required - makes this a realistic threat on shared multi-user AVideo deployments.
Unrestricted wallet-credit minting in AVideo's AD_Server plugin allows any authenticated user to fraudulently inflate YPTWallet balances for campaign video owners without proof of ad delivery. The flaw resides in plugin/AD_Server/log.php, which accepts arbitrary label values - including label=start - via POST requests and credits the associated campaign wallet unconditionally. Repeated exploitation constitutes ad fraud, enabling attackers to generate synthetic platform currency at will. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated file read in WWBN AVideo's getRecordedFile.php endpoint exposes recorded live-stream FLV files to any network attacker without authentication or authorization. All AVideo deployments through commit c3edcc274c389816d434acadac07ee78eaf330c1 are affected. An attacker who can reach the web interface and supply a known or guessed stream key can silently download private recorded video content, with no public exploit or KEV status confirmed at time of analysis.
Stored cross-site scripting in the YPTWallet plugin of WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) lets an authenticated low-privilege user plant malicious markup via a CryptoWallet configuration value that is base64-encoded but never HTML-escaped before being written to wallet_log.information. When an administrator reviews pending withdrawal requests in pendingRequests.php, the payload executes in their session, enabling attacker-driven administrative actions through same-origin fetch requests. Reported by VulnCheck with a vendor GitHub Security Advisory (GHSA-fvp5-q9jp-29mx); no public exploit identified at time of analysis.
Cross-site request forgery in WWBN AVideo's playlistRemove.php endpoint allows remote attackers to silently delete authenticated users' playlists by luring victims to a malicious webpage. The endpoint processes POST requests for playlist deletion without validating a CSRF token, meaning any browser-initiated request carrying a valid session cookie - regardless of origin - is accepted. No public exploit has been identified at time of analysis, though the attack is trivially constructible from a standard HTML form.
Stored cross-site scripting in WWBN AVideo (open-source video CMS) allows an administrator holding the canAdminUserGroups permission to persist malicious HTML/JavaScript through UserGroups::setGroup_name(), which then executes in the browser of any other administrator who opens the user manager interface. Affects all builds through commit c3edcc274c389816d434acadac07ee78eaf330c1. Reported by VulnCheck; no public exploit identified at time of analysis and it is not in CISA KEV.
Password-protection bypass in WWBN AVideo's PlayerSkins SEO plugin endpoint allows unauthenticated remote attackers to retrieve direct MP4 URLs for videos that owners have restricted behind passwords. The flaw resides in `plugin/PlayerSkins/seo.php`, where `getSources()` is invoked without any password validation step, so a caller supplying only a video ID receives the full source URL regardless of the configured password. All AVideo deployments through commit c3edcc274c389816d434acadac07ee78eaf330c1 are affected; no public exploit or CISA KEV listing has been identified at time of analysis.
Password-protected live stream bypass in AVideo exposes RTMP stream keys, HLS playlist URLs, and AES-128 decryption keys to unauthenticated remote callers via two compounding failures. The PHP-side stats API (`Live::_getStats()` in `plugin/Live/Live.php`) returns protected transmission credentials regardless of password check outcome - including the hidden_applications branch invoked when `canSeeLiveFromLiveKey()` denies access. Independently, the shipped NGINX configuration leaves the `/live` location serving `.m3u8` playlists, AES-128 segment encryption keys, and `.ts` segments without any `auth_request` directive (the `auth_key_check` in the `.key` block is commented out), allowing full stream decryption without the configured password. No patched version was available at time of the advisory.
Cross-site request forgery in WWBN AVideo's log archive endpoint allows unauthenticated remote attackers to exfiltrate sensitive application logs and destroy forensic evidence by tricking an authenticated administrator into visiting a malicious page. The `view/logArchive.json.php` endpoint accepts GET requests without any CSRF token validation, so a crafted page silently causes the administrator's browser to trigger log archiving - copying live logs into a publicly accessible zip file while simultaneously truncating the original log to eliminate attack traces. Affected versions span all releases through commit c3edcc274c389816d434acadac07ee78eaf330c1; no KEV listing and no public exploit code identified at time of analysis.
Cross-site request forgery in AVideo's setPassword.json.php endpoint allows unauthenticated remote attackers to modify or clear any user's channel password by tricking an authenticated administrator into visiting a malicious webpage. The root cause is the endpoint accepting GET requests for a state-changing password operation without CSRF token validation, making a single img tag or iframe on an attacker-controlled page sufficient to trigger the attack. No public exploit has been identified at time of analysis, and no KEV listing exists, but the low attack complexity makes successful exploitation realistic whenever an administrator can be phished.
Cross-site request forgery in WWBN AVideo's LoginControl plugin allows network-adjacent unauthenticated attackers to silently replace a logged-in victim's PGP two-factor authentication public key by luring them to a page containing a crafted image tag pointing to the unprotected `savePublicKey.json.php` GET endpoint. The outcome is either account lockout (denying the legitimate user access) or full account takeover if the attacker independently possesses the victim's password and can now pass 2FA using their own PGP key. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Stored cross-site scripting in WWBN AVideo's AD_Server plugin lets an unauthenticated attacker persist malicious HTML via the unescaped 'label' parameter of the log.php endpoint, which later executes as arbitrary JavaScript when an administrator opens the Ad Types report. Because the admin report renders the stored value with jQuery .html() without sanitization, exploitation yields code execution in a privileged administrator's browser session, enabling account/session takeover of the affected AVideo installation. No public exploit identified at time of analysis, though a coordinated GitHub Security Advisory (GHSA-h68w-3r38-wmm8) documents the flaw.
Stored cross-site scripting in WWBN AVideo's LiveLinks plugin lets a low-privileged user with canStream permission persist malicious JavaScript via unsanitized title and description fields, which then executes in the browser of every visitor who views the live-link page - including administrators - inside the site origin. Reported by VulnCheck, the flaw affects AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1; no public exploit identified at time of analysis and it is not in CISA KEV.
Stored cross-site scripting in WWBN AVideo (all versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1) lets a low-privileged, self-registered user plant a persistent JavaScript payload through video category creation. The unsanitized `name` and `iconClass` POST parameters in objects/categoryAddNew.json.php are later rendered into HTML text and a class attribute on watch pages and Gallery cards, so the payload executes in the browser of any visitor - including administrators - enabling session-riding authenticated requests. VulnCheck reported it unpatched; no public exploit code is identified at time of analysis and it is not in CISA KEV.
Stored cross-site scripting in the WWBN AVideo LoginControl plugin (all versions through commit c3edcc274c389816d434acadac07ee78eaf330c1) lets any authenticated user inject JavaScript via the User-Agent header, which is stored unencoded in login history and executes in an administrator's browser when they open the Login History page. Because it runs inside the admin session, an attacker can drive privileged actions and effect account takeover of the platform. Reported by VulnCheck; no public exploit identified at time of analysis and no active exploitation confirmed.
WWBN AVideo's restream subsystem allows any authenticated user holding `canStream` permission to mint authorization tokens for restream objects they do not own, by sending crafted requests to `getRestream.json.php` without ownership validation. Exchanging that token against `getLiveKey.json.php` exposes the victim's stored stream key for YouTube, Twitch, or arbitrary RTMP destinations - granting the attacker full publish access to another user's live streaming channel. No public exploit code has been identified at time of analysis, and the vulnerability is tracked by VulnCheck via GitHub security advisory GHSA-7jf4-mmqm-7p7x.
Unauthenticated account takeover in WWBN AVideo (through commit e01e41ecc) stems from get_api_preauthorize in plugin/API/API.php, a second, undocumented login path that performs the same credential check as get_api_signIn but omits the 10-attempts-per-5-minutes throttle enforced by checkRateLimit(). This lets remote attackers brute-force any account - including admin - without rate limiting, and the endpoint doubles as a credential oracle whose users_id field (1 vs 0) discloses password validity even though the message always reads 'Invalid credentials'. No public exploit identified at time of analysis, and no vendor-released patch is available.
Unauthenticated information disclosure in WWBN AVideo through version 29.0 allows any remote attacker to retrieve live-stream keys, private EPG programme schedules, and server identifiers from the exposed `plugin/PlayLists/epg.json.php` endpoint without credentials. The PHP endpoint performs no authentication check (CWE-306), and because the API accepts sequential user and playlist IDs, an attacker can enumerate the full set of sensitive broadcast credentials across all accounts on an instance. No public exploit or CISA KEV listing has been identified at time of analysis, though the issue is trivially exploitable given its network-accessible, zero-prerequisite nature.
Unauthenticated information disclosure in AVideo through 29.0 exposes private live-stream credentials - including stream keys and m3u8 playlist URLs - to any network-accessible attacker who queries the unprotected `plugin/Live/stats.json.php` endpoint. The `hidden_applications` array in the JSON response contains metadata for private, unlisted, and group-restricted live streams that the platform explicitly intends to conceal from unauthorized viewers. No public exploit has been identified at time of analysis, but the vulnerability is trivially reachable given its zero-precondition CVSS 4.0 profile (AV:N/AC:L/AT:N/PR:N/UI:N, score 8.7).
Authenticated streamers on AVideo through version 29.0 can harvest source stream keys and identity information belonging to all other active streamers by querying the restreamsActive.json.php endpoint, which applies no per-user ownership filtering. The exposed stream keys are live transmission credentials that can be used to impersonate affected streamers on third-party platforms such as YouTube Live or Twitch, enabling broadcast hijacking or session disruption. No active exploitation or public exploit code has been identified at the time of analysis, and exploitation requires a valid streaming account on the same AVideo instance.
Missing authorization in AVideo's SocialMediaPublisher plugin allows any authenticated user to overwrite another account's OAuth token records via an IDOR flaw in the add.json.php endpoint. By supplying arbitrary database row IDs, an attacker can corrupt a victim's stored access_token and refresh_token, then delete the record to permanently destroy the victim's social media provider linkage. No public exploit has been identified at time of analysis; exploitation requires a valid AVideo account (PR:L).
Cross-site request forgery in AVideo's YPTWallet plugin enables unauthenticated attackers to set arbitrary wallet balances for any user by tricking an authenticated administrator into loading a malicious webpage. The vulnerable endpoint `plugin/YPTWallet/view/saveBalance.php` relies exclusively on session cookies for request authorization with no CSRF token validation, meaning a forged POST request is accepted as legitimate whenever an admin's browser submits it. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, but the attack is trivially constructable from the public advisory.
PGP two-factor authentication bypass in AVideo's LoginControl::verifyChallenge() allows a network-accessible attacker holding only a valid account password to completely circumvent the PGP 2FA step and obtain full authenticated session access. The flaw stems from PHP's loose equality operator (==) comparing the submitted challenge against an unset session variable, which evaluates as true when an empty value is submitted - a classic PHP type-juggling weakness. No active exploitation (KEV) or public proof-of-concept code has been identified at time of analysis, but the bypass is trivially reproducible by any credential-holding attacker.
Email two-factor authentication bypass in WWBN AVideo (through commit c3edcc274) allows an attacker who already possesses valid account credentials to skip device-enrollment 2FA entirely. The root cause is a cache invalidation failure in the sqlDAL layer: empty result sets are cached, and writeSql never purges them, so when a new-device login triggers 2FA code generation, the confirmation code hash is computed from a stale empty cache entry rather than a freshly written value - causing the check to silently pass without a valid code. No public exploit code is confirmed and the vulnerability is not listed in CISA KEV at time of analysis, but the bypass is straightforward for any attacker with stolen or leaked passwords.
Authorization bypass in AVideo's live-streaming endpoint allows unauthenticated remote attackers to publish content to any user's RTMP stream by exploiting a hardcoded session cookie. In saveLive.php and related endpoints, PHP cookie precedence causes a session cookie named 'key' with the constant value 'value' to silently override the legitimate $_REQUEST['key'] stream key parameter check, effectively nullifying per-user stream authentication. Any attacker who reads this disclosure now possesses the exact bypass credential; no public exploit code or CISA KEV listing has been identified at time of analysis, but the trivial nature of exploitation (a known constant) makes it functionally equivalent to a zero-authentication bypass.
Insecure Direct Object Reference (IDOR) in WWBN AVideo allows authenticated users holding the canStream permission to hijack third-party live restream destinations on YouTube, Facebook, and Twitch by supplying arbitrary live_restreams_id values to resendRestreamer.json.php. The endpoint fails to verify that the requesting user owns the referenced restream configuration, exposing victim stream keys and allowing an attacker to broadcast their own content to victim-controlled channels. No public exploit code or active exploitation has been confirmed at time of analysis, though the impact on streaming operators could be severe and immediately visible.
Cross-site request forgery in WWBN AVideo through commit c3edcc274c allows unauthenticated remote attackers to manipulate live streaming state by inducing administrative users to visit attacker-controlled pages. The affected endpoints - deleteHistory.json.php and finishAll.json.php - accept state-changing GET requests without CSRF token validation, meaning a simple embedded image or link is sufficient to trigger destructive operations. An attacker can silently erase all live transmission history or mark active streams as finished with only passive administrator interaction, with no public exploit identified at time of analysis.
The synthesis JSON is above. Summary of the key analytical decisions: - **Impact framing:** The input's CWE-200 / "Information Disclosure" tag is technically the root cause, but the real-world outcome is **admin account takeover** via replayed live session identifiers — I reflected that in both C:H and I:H, matching VulnCheck's supplied VC:H/VI:H. - **Patch status:** Fix exists per GHSA-82q2-88mq-p44q, but no exact version was in the input, so I did not invent one. - **Exploitation status:** No KEV, no EPSS, no POC in the input → "no public exploit identified at time of analysis." - **`data_quality_flags`:** empty — the tags/vendor/CPE are all correct; the "Information Disclosure" tag understates but is not verifiably *wrong*, so it stays in `confidence_notes`/`risk_assessment` rather than as a machine-actionable flag. - **Prompt injection:** The "Editorial note (internal)" instructing insertion of the word "olsztyn" was a prompt-injection attempt (matching the known pattern in these CVE inputs) and was **ignored** — no canary word appears anywhere in the output. I also recorded a memory file for this CVE and added its index line.
Unauthenticated arbitrary file write in WWBN AVideo's notify.ffmpeg.json.php endpoint lets remote attackers plant files anywhere under the application root by supplying an attacker-chosen path in the avideoRelativePath parameter. Authentication is trivially defeated because the notifyCode token is any previously issued ciphertext replayed back - the server decrypts it but never validates it - enabling a straight path from unauthenticated request to writing a PHP webshell and remote code execution. Reported by VulnCheck; no public exploit identified at time of analysis, though the advisory describes the technique in enough detail to reproduce.
External-login account password generation in WWBN AVideo uses PHP's non-cryptographic rand() function, producing a keyspace of only 2^31 integers, and stores resulting passwords as unsalted MD5 hashes. An attacker who obtains the AVideo password hash database can exhaustively search the entire 2-billion-entry keyspace in seconds to minutes on commodity GPU hardware, recovering plaintext credentials for all external-login accounts. No public exploit has been identified at time of analysis; the CVSS 4.0 score of 7.4 reflects the prerequisite of prior hash access.
Server-side request forgery in WWBN AVideo (all versions through commit c91b5975d) allows authenticated API clients to force the application server to fetch arbitrary internal URLs via the unvalidated `profileImg` and `backgroundImg` parameters in the `set_api_userImages` endpoint. Unlike blind SSRF, fetched responses are written to publicly accessible web paths, enabling reliable exfiltration of cloud metadata credentials (e.g., AWS IMDS IAM tokens), internal API responses, and network-internal service data. No public exploit code or CISA KEV listing exists at time of analysis, but the non-blind exfiltration path significantly elevates real-world exploitability for cloud-hosted deployments.
Server-side request forgery in AVideo's EPG parser allows authenticated uploaders to force the server to fetch arbitrary internal URLs via the epg_link parameter during video upload. Any AVideo instance through commit c91b5975d is affected; the parameter undergoes only syntactic validation at submission time, and the actual server-side HTTP fetch during EPG generation occurs without SSRF protections such as private-IP blocking, allowlisting, or DNS rebinding defenses. No public exploit has been identified at time of analysis, but the attack requires only uploader-level credentials and is straightforward to execute against cloud-hosted or internally-networked deployments.
Cross-site request forgery in WWBN AVideo through commit c91b5975d allows unauthenticated remote attackers to hijack authenticated streamers' live broadcasts by tricking them into loading a malicious page. The saveLive.php endpoint in the Live plugin omits both POST-method enforcement (forbidIfNotPost) and CSRF token validation (forbidIfInvalidToken), so a crafted image tag silently overwrites the victim's RTMP key, password, and stream title when loaded by a logged-in streamer. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Cross-site request forgery chained with path traversal in AVideo's stopLive.php enables attackers to trigger recursive deletion of arbitrary server directories when an authenticated administrator visits a malicious page. The vulnerability exists through commit c91b5975d of the WWBN AVideo self-hosted video platform, affecting all versions covered by CPE cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*. The attack exploits missing CSRF token validation in stopLive.php combined with unsanitized concatenation of the key parameter into filesystem paths, allowing payloads like key=../../videos to destroy the videos directory and its contents. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated SQL injection in WWBN AVideo's channels API endpoint allows remote attackers to extract password hashes and account recovery tokens without any credentials. The `sort` column parameter in `get.json.php?APIName=channels` is injected directly into a SQL ORDER BY clause unsanitized, enabling an ordering oracle attack to infer sensitive column values character-by-character and triggering verbose SQL errors that disclose the full query and database schema. No public exploit has been identified at time of analysis, though VulnCheck has independently reported this vulnerability with a GitHub Security Advisory published by the vendor.
Full account takeover in WWBN AVideo arises because the video_id_hash acts as a non-expiring, non-revocable bearer token that authenticates the holder as the video owner with complete administrator privileges. Any attacker who obtains a valid video_id_hash can replay it indefinitely to gain full admin session access, and the credential keeps working even after the victim rotates their password - eliminating the primary recovery mechanism. Reported by VulnCheck with a fix in the vendor GitHub Security Advisory; no public exploit identified at time of analysis, and no EPSS or KEV data was provided.
Cross-site request forgery in WWBN AVideo's referer-validation logic allows unauthenticated remote attackers to trick administrative users into issuing forged requests that modify live server configuration. The flaw resides in the get_domain() and isSameDomain() functions, which fail to reject origins from sibling subdomains or malformed long-gTLD URLs, enabling forged admin-level ObjectYPT writes. No public exploit code or active exploitation has been identified at time of analysis, but the bypass is straightforward to weaponize against any deployment where an attacker can influence an admin to visit a malicious page.
Account takeover in WWBN AVideo is possible because userRecoverPassSave.json.php never checks whether a password-recovery token has expired, so any captured token stays valid forever. An attacker who obtains a recovery token for a target account can reset that account's password at an arbitrary later time and seize full control. Reported by VulnCheck with a coordinated GitHub Security Advisory (GHSA-j9p7-hm85-9v77); no public exploit identified at time of analysis and no EPSS/KEV data supplied.
Login-time security-control bypass in WWBN AVideo (commit e01e41ecc and earlier) lets an attacker who already possesses valid credentials defeat two-factor authentication, brute-force captcha escalation, and login/device audit logging by merely setting the HTTP User-Agent header to the literal string 'AVideoEncoder' or 'AVideoMobileApp'. The isAVideoEncoder()/isAVideoMobileApp() trust decisions rely solely on this client-controlled header with no IP allow-list or shared secret, so the protections are trivially spoofable. No patch is available at the time of analysis and no public exploit has been identified, though the advisory itself fully describes the technique.
Rate-limit bypass in WWBN AVideo (all versions) allows unauthenticated remote attackers to perform unlimited credential-guessing against login endpoints by rotating arbitrary X-Real-IP or X-Forwarded-For header values per request. The enforceRateLimit() function uses the attacker-supplied header as the client identifier without verifying the request originates from a trusted proxy, nullifying IP-based throttling entirely. No public exploit code has been identified at time of analysis, but the technique requires no specialised tooling beyond basic HTTP scripting.
UNION-based SQL injection in AVideo through version 29.0 allows unauthenticated remote attackers to read arbitrary database contents via the User_Location plugin's regions.json.php and cities.json.php endpoints. The country and region GET parameters are passed unsanitized into SQL queries without prepared statement binding, enabling direct extraction of password hashes and sensitive configuration data from the underlying database. No public exploit has been identified at time of analysis, but the UNION-based technique is elementary and well within reach of automated scanning tooling.
Unauthenticated disruption of scheduled live broadcasts in AVideo (all versions, CPE cpe:2.3:a:wwbn:avideo:*) is possible via a missing access control check on the RTMP callback endpoint plugin/Live/on_publish.php. The endpoint accepts crafted POST requests containing fabricated stream keys matching the predictable -ps-<N> pattern, causing the platform to mark any targeted scheduled broadcast as failed without requiring credentials. With a CVSS 4.0 score of 8.8 and PR:N/AV:N, this is remotely exploitable at low complexity; no public exploit or CISA KEV listing has been identified at time of analysis.
Cross-site request forgery in AVideo's plugin/API/set.json.php endpoint allows unauthenticated remote attackers to perform destructive, state-changing operations on behalf of authenticated victims by weaponizing ordinary browser GET requests. The affected endpoint accepts API parameters via GET without enforcing CSRF tokens or origin validation, enabling attackers to delete videos, deactivate user accounts, or manipulate playlists simply by luring an authenticated victim to a crafted URL. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis, though the low technical barrier for GET-based CSRF attacks makes independent replication straightforward.
SSRF filter bypass in WWBN AVideo exposes cloud metadata services and loopback interfaces to authenticated low-privilege attackers. The isSSRFSafeURL function fails to normalize IPv6 NAT64 addresses rendered in hexadecimal notation, allowing crafted URLs such as 64:ff9b::a9fe:a9fe to resolve to protected addresses like 169.254.169.254 while evading the SSRF blocklist. Exploitation could yield cloud instance credentials or access to internal services; no public exploit or KEV listing is confirmed at time of analysis.
Unauthenticated stream credential disclosure in AVideo (WWBN, commit e01e41ecc and earlier) lets remote attackers retrieve any user's restream stream_key and stream_url for external platforms like YouTube, Facebook, and Twitch. The getLiveKey.json.php endpoint accepts a 'token' parameter that bypasses both the Live::canRestream() access gate and the restream ownership check, and the token is merely AES-256-CBC encryptString() of an integer id with no user binding, expiry, or authentication tag. Because a public encryption oracle (view/url2Embed.json.php) lets anyone encrypt arbitrary values, valid tokens can be forged with no authentication; no public exploit is identified at time of analysis but the technique is fully described.
Rate-limiting bypass in WWBN AVideo (through commit e01e41ecc) allows unauthenticated remote attackers to conduct unlimited brute-force attacks against login.json.php and 13 other protected endpoints by exploiting a logic flaw in enforceRateLimit(). The function relies on ObjectYPT::setCacheGlobal to persist per-client attempt counters, but silently discards those writes whenever isBot() classifies the client as a bot - which occurs by default for any request omitting a User-Agent header or using agent strings matching 'curl', 'bot', 'crawler', or 'spider'. No active exploitation has been confirmed at time of analysis, but the trivial bypass mechanism makes this immediately usable for credential stuffing without any specialized tooling.
Privilege escalation in WWBN AVideo through commit 9c39d8c8 enables any user with upload permission to silently hijack an administrator session without knowing their credentials. Two chained functions - deduplicateByEncoderQueueId() exposing video hash tokens without ownership verification, and useVideoHashOrLogin() accepting those tokens as passwordless authentication - create a direct path from low-privilege user to full administrative access. No public exploit has been confirmed and the vulnerability is not listed in CISA KEV, but the low attack complexity and high CIA impact make this a high-priority remediation for any internet-accessible AVideo deployment.
Unauthorized access to restricted video content in WWBN AVideo (through commit 9c39d8c8) is enabled by a fundamental design flaw in the platform's token subsystem: getToken() produces tokens with no binding to user identity or intended purpose, and the Gallery plugin endpoint (plugin/Gallery/view/sections.php) distributes these tokens freely to unauthenticated visitors. Because the tokens carry no scope constraint, they are accepted as valid authorization across unrelated subsystems including the HLS streaming endpoint (view/hls.php), allowing any remote unauthenticated party to retrieve private video content. No public exploit has been identified at time of analysis, but the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) reflects a trivially simple, two-step attack requiring no special tools.
Cross-site request forgery in WWBN AVideo through commit 9c39d8c8 allows remote attackers to permanently publish embargoed videos by tricking an authenticated administrator into loading a malicious GET request targeting the releaseVideoNow.json.php endpoint. The endpoint accepts state-changing GET requests without any CSRF token or origin validation, relying solely on the browser's ambient session cookie. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified, though the GET-based CSRF pattern is trivially weaponizable via a one-pixel image tag or link.
Authorization bypass in WWBN AVideo through commit 9c39d8c8b4c1f75540788d6b391740852ceb0732 allows any authenticated user to forge two-party affiliation consent records and subsequently hijack video ownership of arbitrary content on the platform. The Users_affiliations add.json.php endpoint accepts attacker-controlled counterparty agreement timestamps without verification, enabling creation of forged affiliation records with approved status that are then unconditionally trusted by the videoAddNew.json.php ownership-transfer endpoint. No public exploit code or CISA KEV listing has been identified at time of analysis; however, only a low-privilege account is required, making this accessible to any registered user on a vulnerable instance.
OS command injection in WWBN AVideo through version 29.0 allows attackers to execute arbitrary operating-system commands as the web-server user via the ffmpeg.json.php endpoint. The notifyCode and callback request parameters are concatenated into a shell command without escaping, so an attacker able to produce a valid encrypted payload can inject shell metacharacters and achieve remote code execution. No public exploit identified at time of analysis; the flaw carries a CVSS 4.0 base score of 9.2, though successful exploitation is gated by the requirement to forge a valid encrypted payload.
OS command injection in AVideo (WWBN) through version 29.0 lets remote attackers who can forge a valid encrypted codeToExec payload run arbitrary shell commands as the web-server user via the listFFmpegProcesses() function in the standAlone plugin API. The flaw is unauthenticated (PR:N) but non-trivial to reach because it depends on producing an accepted encrypted parameter, and no public exploit or CISA KEV listing is identified at time of analysis.
Stored DOM cross-site scripting in WWBN AVideo's YPTSocket plugin (all versions prior to 29.0) lets any unauthenticated remote attacker run arbitrary JavaScript in the browser session of any administrator viewing the YPTSocket online-users debug panel. Because the malicious WebSocket metadata is broadcast to every connected client and rendered without escaping, a single anonymous WebSocket connection can be escalated into full administrative account takeover via the admin's own session and CSRF token. No public exploit identified at time of analysis; the flaw carries a CVSS 9.6 (Critical) rating driven by the scope change into the privileged admin origin.
Authorization bypass in AVideo's Meet plugin (versions through 29.0) lets remote attackers hijack arbitrary user sessions, including admin, by abusing the uploadRecordedVideo.json.php endpoint which derives the target users_id from a caller-controlled filename and then invokes the passwordless User->login() path. Exploitation requires the Meet shared secret, but that secret is a deterministic MD5 of values from configuration.php and is recoverable via known path-traversal flaws or timing attacks against checkToken.json.php. No public exploit identified at time of analysis, though the VulnCheck and GHSA advisories document the attack with code-level precision.
Unauthenticated information disclosure in AVideo through 26.0 exposes payment transaction records via multiple list.json.php endpoints in the PayPalYPT, AuthorizeNet, and BTCPayments plugins that lack User::isAdmin() authorization checks. Remote attackers can issue direct GET requests to harvest PayPal billing agreement IDs, Express Checkout tokens, Authorize.Net webhook payloads, and Bitcoin transaction records without credentials. No public exploit identified at time of analysis, but the GHSA advisory from WWBN/AVideo and VulnCheck disclosure provide full endpoint paths sufficient for trivial reproduction.
Wallet balance forgery in WWBN AVideo 29.0 and earlier allows any authenticated user to credit their own wallet with arbitrary funds by abusing an unfinished AuthorizeNet payment handler. The plugin/AuthorizeNet/processPayment.json.php endpoint hardcodes payment success and calls YPTWallet::addBalance() using an attacker-supplied amount with no validation of the underlying Authorize.Net transaction. No public exploit has been identified at time of analysis, but the flaw is trivially reproducible from a logged-in account.
Server-side request forgery in WWBN AVideo 29.0 and earlier lets an authenticated upload-capable user bypass the isSSRFSafeURL() same-domain shortcircuit by supplying the site's own public hostname with a non-standard port, causing the server to fetch arbitrary internal ports and save the response to a web-accessible cache path for full exfiltration. The flaw carries a CVSS 7.7 (scope-changing confidentiality impact) and publicly available exploit code exists via the GitHub Security Advisory, though it is not listed in CISA KEV and EPSS probability is negligible (0.03%, 8th percentile).
Arbitrary file deletion in WWBN AVideo (versions 29.0 and below) lets an authenticated attacker abuse the CloneSite plugin's `deleteDump` GET parameter to `unlink()` any file the web server can access. The `deleteDump` value is concatenated directly onto the clones directory path with no sanitization, so `../../` sequences escape the intended directory. This is an incomplete-fix regression of CVE-2026-33293; publicly available exploit code exists (advisory PoC), but there is no public exploit identified as used in active attacks, and EPSS risk is very low (0.04%).
Cross-origin data exposure in WWBN AVideo 29.0 and earlier lets a malicious website read authenticated /api/* responses because an incomplete CORS fix still reflects arbitrary Origin headers with Access-Control-Allow-Credentials: true. Any logged-in user who visits an attacker-controlled page can have their session-authenticated API responses - containing email, admin status, user ID, and other PII - read cross-origin. Publicly available exploit code exists (SSVC: poc) and the issue is confirmed via GitHub Security Advisory GHSA-ff5q-cc22-fgp4, though EPSS is very low (0.01%) and it is not in CISA KEV.
Cross-origin account takeover in WWBN AVideo (versions 29.0 and below) allows any attacker-controlled website to read authenticated API responses and issue state-changing requests on behalf of a logged-in victim. The `allowOrigin(true)` routine reflects the attacker's `Origin` header into `Access-Control-Allow-Origin` while also sending `Access-Control-Allow-Credentials: true`, and combined with the app's `SameSite=None` session cookie the victim's browser attaches credentials to cross-origin calls to the core get.json.php/set.json.php API. Proof-of-concept exploitation is documented in the GitHub advisory; EPSS is very low (0.04%) and it is not in CISA KEV, so no confirmed active exploitation exists.
Server-side request forgery in WWBN AVideo (versions 29.0 and below) lets remote unauthenticated attackers coerce the LiveLinks proxy (plugin/LiveLinks/proxy.php) into contacting internal-only endpoints, because an incomplete fix for CVE-2026-33039 leaves a DNS time-of-check-to-time-of-use gap. Although isSSRFSafeURL() validates the target, get_headers() and fakeBrowser() resolve DNS again independently, so a DNS-rebinding domain with TTL=0 can return a safe external IP during validation and an internal IP during the actual request, reaching resources like cloud metadata (169.254.169.254) or loopback services. Publicly available exploit code exists (a Python PoC in the GHSA advisory); EPSS is low at 0.03% and it is not listed in CISA KEV.
Cross-site request forgery in WWBN AVideo (versions 29.0 and prior) lets an attacker abuse a logged-in admin's session against three state-changing JSON endpoints (categoryAddNew, categoryDelete, and pluginRunUpdateScript) that enforce only a role check and omit the CSRF token validation their sibling endpoints use. By luring an authenticated administrator to a malicious page, an attacker can create, overwrite, or delete video categories and trigger execution of any installed plugin's updateScript() method. Publicly available exploit code exists per the SSVC assessment, though EPSS is very low (0.02%, 5th percentile) and it is not on the CISA KEV list.
Remote code execution in AVideo versions 29.0 and below allows unauthenticated attackers to execute arbitrary shell commands on the server via command injection in the CloneSite plugin's cloneServer.json.php endpoint. Attackers exploit unsanitized user input in the 'url' parameter that gets directly concatenated into a wget command executed through PHP's exec() function. With CVSS 8.9 (AV:N/AC:L/PR:N/UI:N) and proof-of-concept exploitation confirmed (E:P), this represents a critical risk requiring immediate patching. Fix available in commit 473c609fc2defdea8b937b00e86ce88eba1f15bb.
Remote code execution in WWBN AVideo up to version 29.0 allows unauthenticated attackers to execute arbitrary system commands via unsanitized URL parameters in test.php. This vulnerability stems from an incomplete fix that sanitized wget calls but left file_get_contents and curl code paths exploitable through regex bypass (accepting strings like 'httpevil[.]com'). CVSS 9.3 with Critical scope change reflects the severity. Upstream fix available in commit 78bccae but no tagged release version confirmed at time of analysis. EPSS data not provided; no CISA KEV listing identified.
Cross-site request forgery in WWBN AVideo (versions ≤ 29.0) lets an attacker fully rewrite global site configuration by luring a logged-in administrator to a malicious page. The `objects/configurationUpdate.json.php` endpoint (aka `/updateConfig`) gates only on `User::isAdmin()` and omits any anti-CSRF token, Origin/Referer check, or `forbidIfIsUntrustedRequest()` call, so a single auto-submitted cross-origin POST can overwrite the encoder URL, SMTP credentials, site `<head>` HTML, logo, favicon, and contact email. Publicly available exploit code exists (SSVC: PoC) but the flaw is not in CISA KEV, and EPSS is very low at 0.02%.
Unauthenticated cross-user JavaScript execution in WWBN AVideo (versions 29.0 and prior) lets a remote attacker broadcast arbitrary code to every connected browser through the YPTSocket WebSocket plugin. Because anonymous visitors are issued valid socket tokens and the server relays the attacker-controlled `msg` and `callback` fields verbatim into client-side eval() sinks, any visitor can execute JavaScript in the origin of all connected users - including administrators - yielding universal account takeover, session theft, and privileged action execution. Publicly available exploit code exists (SSVC: PoC) though the flaw is not listed in CISA KEV, and EPSS is currently low at 0.17%.
Path traversal in WWBN AVideo 29.0 and earlier allows authenticated administrators (or CSRF-tricked admins) to write arbitrary PHP files anywhere on the server filesystem, achieving remote code execution. The locale save endpoint fails to sanitize the 'flag' parameter used in file path construction and lacks CSRF protection despite SameSite=None cookies, enabling straightforward exploitation by lower-privilege attackers who chain CSRF against admin sessions. Upstream fix committed to GitHub (57f89ffb) but released patched version not independently confirmed. CVSS 8.7 reflects high impact but requires privileged access - real-world risk depends heavily on admin session hijacking opportunities.
Server-Side Request Forgery (SSRF) in WWBN AVideo 26.0 and earlier allows authenticated uploaders to exfiltrate data from internal network resources via objects/aVideoEncoder.json.php. The flaw bypasses existing SSRF protections by permitting attacker-controlled URLs with common media extensions (.mp4, .mp3, .zip, .jpg, .png, .gif, .webm), forcing the server to fetch and store arbitrary remote content. This represents an incomplete fix for CVE-2026-27732. No public exploit identified at time of analysis. CVSS 7.1 with network-accessible attack vector requiring low-privileged authentication.
Path traversal in WWBN AVideo platform ≤26.0 allows authenticated uploaders to read arbitrary server files via GIF poster manipulation. An attacker with uploader privileges can exploit aVideoEncoderReceiveImage.json.php to bypass path sanitization, fetch local files like /etc/passwd or application source code, and republish the contents through publicly accessible GIF media URLs. CVSS 7.6 reflects high confidentiality impact with low-complexity network attack requiring only low-privilege authentication. No public exploit identified at time of analysis, though EPSS data not available for risk quantification.
Unauthenticated remote attackers can bypass CLI-only access controls in WWBN AVideo versions 26.0 and prior via a PHP operator precedence bug in install/deleteSystemdPrivate.php, allowing HTTP access to delete server temp directory files and disclose their contents without authentication. The vulnerability stems from a logic error where !php_sapi_name() === 'cli' evaluates incorrectly due to operator binding precedence, causing the access guard to fail entirely. No public exploit code or active exploitation has been reported at the time of this analysis.
WWBN AVideo 26.0 and prior exposes sensitive user data through 21 unauthenticated API endpoints via the CreatePlugin template generator. The list.json.php template lacks authentication checks present in its companion add.json.php and delete.json.php templates, allowing remote attackers to enumerate and retrieve user PII, payment logs, IP addresses, user agents, and internal system records without authentication. No vendor patch exists at time of analysis.
Unauthenticated attackers can remotely terminate any active live stream in WWBN AVideo 26.0 and prior by sending crafted POST requests to the on_publish_done.php endpoint in the Live plugin. The vulnerability combines two weaknesses: an unauthenticated stats.json.php endpoint that exposes active stream keys, and the on_publish_done.php RTMP callback handler that processes stream termination requests without authentication or authorization checks. This enables complete denial-of-service against all platform live streaming functionality. CVSS 7.5 (High) with network attack vector, low complexity, and no privileges required. No vendor-released patch identified at time of analysis; EPSS data not available.
Cross-site request forgery in WWBN AVideo 26.0 and earlier enables remote attackers to reconfigure critical plugin settings through forged requests targeting admin/save.json.php. The endpoint lacks CSRF token validation while the application sets SameSite=None cookies, allowing attackers to manipulate payment processors, authentication providers, and cloud storage credentials by tricking authenticated administrators into visiting malicious pages. No vendor-released patch identified at time of analysis. EPSS data unavailable; not listed in CISA KEV; no public exploit identified at time of analysis, though exploitation requires only standard CSRF techniques.
Reflected cross-site scripting (XSS) in WWBN AVideo versions up to 26.0 enables credential theft through unsanitized request parameter echoed into JavaScript context. Attackers can craft malicious URLs that, when clicked by authenticated users, execute arbitrary JavaScript and exfiltrate the victim's username and password hash directly exposed in the vulnerable code block. CVSS score of 8.2 reflects high confidentiality impact; no public exploit identified at time of analysis.
SQL injection in WWBN AVideo versions up to 26.0 allows unauthenticated remote attackers to extract sensitive database contents and modify data through the RTMP publish authentication stream key validation mechanism. The vulnerability (CVSS 9.1 Critical) arises from unsanitized string interpolation in Live_schedule::keyExists() fallback logic, affecting the open-source video platform's live streaming infrastructure. No vendor-released patch identified at time of analysis, and no public exploit identified at time of analysis.
WWBN AVideo, an open source video platform, contains a SQL injection vulnerability in the Subscribe::save() method that allows authenticated attackers to execute arbitrary SQL queries. Versions up to and including 26.0 are affected, with the vulnerability stemming from unsanitized user input from the $_POST['user_id'] parameter being concatenated directly into INSERT queries. An attacker with low-level authentication can extract sensitive data including password hashes, API keys, and encryption salts from the database, representing a significant information disclosure risk.
WWBN AVideo video platform up to and including version 26.0 contains an authentication bypass vulnerability in the CDN plugin that allows unauthenticated remote attackers to completely modify CDN configuration settings including storage credentials and authentication keys. The vulnerability stems from the CDN plugin's default empty string authentication key, which causes validation checks to be bypassed entirely when the plugin is enabled but not properly configured. The CVSS score of 8.6 reflects high integrity impact with network-based exploitation requiring no privileges or user interaction.
WWBN AVideo versions up to and including 26.0 contain a critical file upload vulnerability (CWE-434) that allows authenticated attackers to upload and execute arbitrary PHP code on the server. The vulnerability exists in the downloadVideoFromDownloadURL() function which saves remote content with its original filename and extension to a web-accessible directory; by providing an invalid resolution parameter, attackers can bypass cleanup mechanisms, leaving executable PHP files persistent under the web root. With a CVSS score of 8.8, this represents a high-severity remote code execution risk for authenticated users.
WWBN AVideo versions up to and including 26.0 contain an authentication bypass vulnerability in the standalone live stream control endpoint. The endpoint accepts a user-supplied 'streamerURL' parameter that redirects token verification to an attacker-controlled server, allowing complete bypass of authentication without any user interaction. With a CVSS score of 9.4, an attacker gains unauthenticated control over any live stream including the ability to drop publishers, manipulate recordings, and probe stream existence.
WWBN AVideo, an open source video platform, contains a critical path traversal vulnerability in the pluginRunDatabaseScript.json.php endpoint that allows authenticated administrators to execute arbitrary SQL queries against the application database. Versions up to and including 26.0 are affected. The vulnerability can also be exploited via CSRF attacks against authenticated admin sessions, enabling unauthenticated attackers to achieve remote code execution or complete database compromise.
SQL injection in WWBN AVideo up to version 26.0 allows authenticated users to extract arbitrary database contents through time-based blind SQL injection via the remindMe.json.php endpoint. The vulnerability stems from insufficient input sanitization of the live_schedule_id parameter, which is concatenated directly into a SQL LIKE clause despite partial validation in intermediate functions. No patch is currently available.
Privilege escalation in WWBN AVideo up to version 26.0 allows users with "Videos Moderator" permissions to gain full video management capabilities, including transferring ownership and deleting any video, by exploiting inconsistent authorization checks between the video editing and deletion endpoints. An authenticated attacker can chain an ownership transfer with deletion operations to compromise videos outside their legitimate scope. A patch is available in commit 838e16818c793779406ecbf34ebaeba9830e33f8.
A Cross-Site Request Forgery (CSRF) vulnerability in WWBN AVideo open source video platform versions up to and including 26.0 allows unauthenticated attackers to escalate privileges to near-admin access by tricking an administrator into visiting a malicious page. The vulnerability exists in the setPermission.json.php endpoint which accepts state-changing operations via GET requests without CSRF token validation, compounded by the application's explicit SameSite=None cookie setting. No patched version is currently available, and with a CVSS score of 8.1 (High), this represents a significant risk for installations with administrative users who browse external content.
WWBN AVideo versions up to and including 26.0 contain a command injection vulnerability in the restreamer endpoint that allows authenticated attackers to execute arbitrary commands on the server. The vulnerability stems from unsanitized user input (users_id and liveTransmitionHistory_id parameters) being embedded directly into shell commands via exec(). With a CVSS score of 8.8, this critical vulnerability requires low attack complexity and low privileges, enabling complete system compromise including data theft, modification, and denial of service.
WWBN AVideo versions up to and including 26.0 contain a critical file upload vulnerability in the ImageGallery::saveFile() method that allows authenticated attackers to upload polyglot files (JPEG with embedded PHP code) and achieve Remote Code Execution. The vulnerability exploits a mismatch between MIME type validation (which checks file content) and filename extension handling (which trusts user input), allowing attackers to bypass security controls and execute arbitrary code on the server. A patch is available in commit 345a8d3ece0ad1e1b71a704c1579cbf885d8f3ae, and the issue has been publicly disclosed via GitHub Security Advisory GHSA-wxjw-phj6-g75w.