Wvp Gb28181 Pro
Monthly
Path traversal in wvp-GB28181-pro 2.7.4-20260107 exposes arbitrary server files through the Snapshot Endpoint in PlayController.java, where the deviceId and channelId parameters are incorporated into file system operations without sanitization. Authenticated remote attackers with low-privilege access can escape the intended snapshot directory by injecting traversal sequences into these parameters, yielding partial confidentiality, integrity, and availability impact. A publicly available proof-of-concept exploit exists on GitHub (issue #2175), materially lowering the barrier to exploitation despite the moderate CVSS 5.3 score and absence from the CISA KEV catalog.
A deserialization vulnerability exists in the wvp-GB28181-pro project (a video streaming platform using GB28181 protocol) through version 2.7.4, specifically in the GenericFastJsonRedisSerializer implementation within the Redis configuration. The flaw allows unauthenticated remote attackers to exploit insecure deserialization through the API endpoint, potentially achieving code execution or data manipulation with low complexity. A public proof-of-concept exploit has been released on GitHub, significantly increasing the risk of active exploitation, and the vendor has not responded to disclosure attempts.
SQL injection in the Stream Proxy Query Handler component of wvp-GB28181-pro up to version 2.7.4 allows authenticated remote attackers to execute arbitrary SQL queries and potentially read, modify, or delete database contents. Public exploit code exists for this vulnerability, and no patch is currently available. The affected Java application processes unsanitized input in the selectAll function without proper parameterized queries.
Path traversal in wvp-GB28181-pro 2.7.4-20260107 exposes arbitrary server files through the Snapshot Endpoint in PlayController.java, where the deviceId and channelId parameters are incorporated into file system operations without sanitization. Authenticated remote attackers with low-privilege access can escape the intended snapshot directory by injecting traversal sequences into these parameters, yielding partial confidentiality, integrity, and availability impact. A publicly available proof-of-concept exploit exists on GitHub (issue #2175), materially lowering the barrier to exploitation despite the moderate CVSS 5.3 score and absence from the CISA KEV catalog.
A deserialization vulnerability exists in the wvp-GB28181-pro project (a video streaming platform using GB28181 protocol) through version 2.7.4, specifically in the GenericFastJsonRedisSerializer implementation within the Redis configuration. The flaw allows unauthenticated remote attackers to exploit insecure deserialization through the API endpoint, potentially achieving code execution or data manipulation with low complexity. A public proof-of-concept exploit has been released on GitHub, significantly increasing the risk of active exploitation, and the vendor has not responded to disclosure attempts.
SQL injection in the Stream Proxy Query Handler component of wvp-GB28181-pro up to version 2.7.4 allows authenticated remote attackers to execute arbitrary SQL queries and potentially read, modify, or delete database contents. Public exploit code exists for this vulnerability, and no patch is currently available. The affected Java application processes unsanitized input in the selectAll function without proper parameterized queries.