Wwbn
Monthly
Unauthenticated remote attackers can drive AVideo-Encoder's privileged queue processor and read its control and status plane in default installations prior to 8.1.0. Because the application ships no global authentication layer (the bundled .htaccess denies only .git, *.log and avideo.log), the PHP endpoints view/run.php, view/queue.json.php, view/status.php and view/listFiles.json.php are directly reachable and perform their privileged actions for anonymous callers - invoking Encoder::run(), disclosing the job queue and every streamer site URL, returning host memory statistics with a wildcard Access-Control-Allow-Origin header, and enumerating media file names and paths in any directory readable by the web-server user. Impact is bounded to control-plane manipulation and information exposure (no code execution, and enumeration is limited to configured media extensions and does not return file contents); a public PoC reference with anonymous curl requests exists in the vendor advisory, but it is not verified as working exploit code and there is no KEV listing, with priority assessed as remediation this week and a vendor fix available in 8.1.0.
Unauthenticated server-side request forgery in AVideo-Encoder (WWBN / AVideo project) before the 8.1.0 remediation attempt lets anyone who can reach the encoder force it to fetch arbitrary URLs from its own network position, with the raw fetched body reflected back in the JSON login response - enough to harvest cloud instance-metadata credentials or probe internal HTTP, HTTPS, TCP and FTP services. No account or operator interaction is required because the only destination gate (Streamer::isURLAllowed) allows every target when the operator allowlist is empty, which is the default, and TLS peer verification is disabled so untrusted self-signed internal HTTPS endpoints are accepted. A public proof-of-concept reproduction (curl-based) is documented in the vendor security advisory; there is no confirmed active exploitation (not in CISA KEV). Version 8.1.0 is an initial remediation that removes raw-response reflection and adds destination checks, but private-network exemptions and the login TLS-verification default leave the internal-network and TLS variants unresolved.
Unauthenticated OS command injection in AVideo-Encoder before 8.1.0 gives remote attackers arbitrary command execution as the web-server user through the live-streaming endpoint view/videosListToLive.php. The endpoint requires only non-empty playlists_id and APISecret values, forwards APISecret without comparing it to any stored secret, and never applies the Streamer::isURLAllowed allowlist, so an attacker can point webSiteRootURL at an HTTP stub they control, have Login::run adopt the returned JSON as session state (self-granting isLogged and canStream), then return a video list whose videos[].path values are interpolated without escaping into ffprobe and ffmpeg commands run via exec. Successful exploitation discloses database and stored streamer credentials, permits upstream platform compromise, file modification and persistence as the web-server user, and can deny encoder service; the vendor fixed this in 8.1.0 and no public exploit code is confirmed in the supplied data, though the advisory includes a detailed working PoC recipe.
Unauthenticated PHP code injection in AVideo-Encoder before 8.1.0 allows a remote attacker to write arbitrary PHP into videos/configuration.php through install/checkConfiguration.php and execute it as the web-server user. The attack works only while videos/configuration.php is absent-the default on a fresh deployment or after the file is deleted or moved-and requires the attacker to supply a reachable database host, which they control, plus a systemRootPath containing index.php. Version 8.1.0 fixes the flaw; a public PoC reference exists and is not verified as working exploit code, and the decision label is act_now with CVSS 10.0.
Delegated 'Users Admin' accounts in WWBN AVideo before version 29.4.0 can delete, overwrite, or demote full administrator accounts by posting directly to confirmDeleteUser.json.php or userAddNew.json.php with an administrator's user ID, destroying that admin's videos and account in the process. The flaw is a server-side authorization gap: the interface already hides admin-row actions from non-admins, but the endpoints themselves never re-verified that the caller outranks the target, so a crafted request bypasses the cosmetic UI restriction. Exploitation requires an authenticated account holding the Permissions::canAdminUsers() delegated role, so anonymous visitors and ordinary users are not affected; no public exploit code has been identified at time of analysis and no EPSS or CISA KEV signal is present in the available data.
Stored cross-site scripting in WWBN AVideo 12.4 through 29.2.0 allows authenticated users with video-upload privileges to inject arbitrary HTML or JavaScript into video titles using doubly-encoded entities that survive the application's sanitizer. The injected payload executes when a victim views a crafted title on trending, gallery, embed, or playlist pages, enabling limited confidentiality and integrity impact (e.g., session token theft or actions as the victim) when a privileged user loads the page. Exploitation requires an authenticated uploader account and victim interaction; no public exploit identified at time of analysis, and the upstream commit c4b6ca95... provides a fix.
Stored cross-site scripting in WWBN AVideo through 29.2.0 allows an authenticated user who holds video upload permission to store a crafted trailer1 URL that is later rendered without escaping in the YouPHPFlix2 templates (BigVideo.php, BigVideoButtons.php, row_info.php) and in the channel playlist view (channelPlaylistItems.php). The injected value can break out of an onclick='flixFullScreen(...)' / avideoModalIframe(...) JavaScript string or an iframe src attribute, so any visitor who loads an affected page has attacker-controlled JavaScript executed in their browser context. Exploitation requires both a valid upload-capable account (PR:L) and victim interaction with a rendering page (UI:P), and the security impact is realized in the victim's browser rather than directly on the server; no public exploit code or CISA KEV entry was identified at time of analysis, and the vendor advisory and fix commit are already public.
AVideo's PGP second-factor verification can be bypassed, allowing an attacker who already holds a victim's password to complete authentication without ever supplying a valid PGP challenge response. The LoginControl component's verifyChallenge.json.php endpoint compares the submitted response against an uninitialized session variable using PHP loose equality, so a single parameter-less GET request evaluates null == null and marks the login fully authenticated; EUVD tracking places the affected range at AVideo 0 through 29.0. No public exploit code or confirmed active exploitation was identified at time of analysis, but the attack needs only one unauthenticated-to-the-endpoint network request with no user interaction, and the independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, making it a high-priority authentication bypass wherever PGP 2FA is the sole remaining protection and credential theft or reuse is feasible.
Unauthenticated remote attackers can achieve account takeover in AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 by guessing weakly generated activation/login pairing codes. The getRandomCode() function in objects/functions.php relies on uniqid() output, limiting the code space to roughly 2^25 values for a known generation second; the plugin/API/set.json.php?APIName=login_code endpoint leaks server microtime as an oracle, and a guessed valid code (10-minute TTL) redeemed at plugin/API/get.json.php?APIName=login_code yields the victim's email and a one-year User::getUserHash credential. No vendor patch is available and no public exploit code has been identified, though the weak PRNG and unauthenticated oracle make the attack a genuine account-takeover primitive tempered by high attack complexity (AC:H/AT:P) due to the timed probabilistic guess.
Stream-key forgery in WWBN AVideo lets remote unauthenticated attackers reconstruct a live channel's RTMP publish key and broadcast content as the channel owner, by brute-forcing the roughly one million microsecond candidates produced by PHP's uniqid() in the LiveTransmition component. Exploitation requires the live-streaming feature to be in use and the attacker to know or closely estimate the target channel's creation timestamp, which is why exploitability is assessed as high complexity/high attack requirements despite the unauthenticated network vector. Only integrity of the published stream is at stake (no account takeover, code execution, or data disclosure), and no public exploit identified at time of analysis; the raw vendor CVSS 4.0 score of 8.3 overstates the practical ease of exploitation relative to the assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).
Unauthenticated attackers can pull restricted live-stream metadata - including RTMP stream keys, stream titles, descriptions, owner details, and direct HLS playback URLs - from two JSON endpoints in the AVideo Live plugin (plugin/Live/stats.json.php and plugin/Live/calendar.json.php) in all versions up to and including 29.0. The endpoints fail to enforce the platform's user-group access restrictions, so content intended only for members of a specific group is exposed to anyone who can reach the server. No public exploit code or CISA KEV entry was identified at time of analysis, but the flaw is trivially automatable over the network with no credentials or user interaction, and CVSS 4.0 rates it 8.7 with high confidentiality impact.
Missing authorization in WWBN AVideo's Scheduler email plugin exposes private subscriber email addresses, live-stream titles, and scheduled job metadata to any unauthenticated network attacker who can supply a valid site-wide daily token. The daily token is obtainable without authentication from publicly accessible Live pages, making the attack effectively unauthenticated for instances with open Live pages. No public exploit code has been identified at time of analysis, but the attack path is mechanically straightforward and the confidentiality impact is high given the exposure of user email addresses.
Stored cross-site scripting in the WWBN AVideo Bookmark plugin lets a video owner persist a JavaScript payload through the bookmark/chapter name parameter, which is concatenated into public watch-page HTML without output encoding (CWE-79). Every viewer of the affected video then executes attacker-controlled script in the AVideo origin, enabling session/account compromise of ordinary users and administrators. Reported by VulnCheck with a public advisory; no CISA KEV listing and no weaponized exploit code identified, though technical detail in the advisory lowers the barrier to reproduction.
Stored cross-site scripting in the LoginControl plugin of WWBN AVideo allows an authenticated low-privilege user to persist malicious JavaScript by submitting a crafted PGP public key, which is echoed unencoded into a textarea and executes in an administrator's browser session when the admin views the attacker's profile tab. This is a privilege-escalation vector - attacker-controlled script runs with admin session context, enabling account/platform takeover. VulnCheck reported it with a published GitHub Security Advisory; no public exploit is identified at time of analysis and it is not in CISA KEV.
Stored cross-site scripting in WWBN AVideo's CustomizeUser plugin lets an administrator persist an unsanitized field_name value through the add.json.php endpoint, which later executes as script when any user or admin renders the extra-info pages or profile forms via the typeToHTML function. The flaw affects AVideo up through commit c3edcc274c389816d434acadac07ee78eaf330c1 and was reported by VulnCheck; no public exploit identified at time of analysis and it is not in CISA KEV.
Stored cross-site scripting in WWBN AVideo (through commit c3edcc27) lets an authenticated user poison their own 'donationLink' profile field, which is later rendered unencoded inside an <a href="..."> attribute on the video watch page. Because User::save() validates the value only with FILTER_VALIDATE_URL (which accepts embedded double quotes and event handlers) and getDonationLink() applies only strip_tags(), an attacker can break out of the href attribute and execute JavaScript in the browser of any visitor - including an administrator - who hovers over the donation button. Reported by VulnCheck; publicly available exploit code exists via the advisory, and the issue was unfixed at time of reporting.
Missing ownership verification in AVideo's addLiveLink.php enables any authenticated canStream user to hijack another user's LiveLink by supplying a known linkId in an update request, overwriting the victim's HLS source URL and stream metadata without authorization. The flaw affects AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 and allows an attacker to silently redirect the victim's viewers to attacker-controlled media. No public exploit has been identified at time of analysis, but the low privilege bar - only a canStream account is required - makes this a realistic threat on shared multi-user AVideo deployments.
Unrestricted wallet-credit minting in AVideo's AD_Server plugin allows any authenticated user to fraudulently inflate YPTWallet balances for campaign video owners without proof of ad delivery. The flaw resides in plugin/AD_Server/log.php, which accepts arbitrary label values - including label=start - via POST requests and credits the associated campaign wallet unconditionally. Repeated exploitation constitutes ad fraud, enabling attackers to generate synthetic platform currency at will. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated file read in WWBN AVideo's getRecordedFile.php endpoint exposes recorded live-stream FLV files to any network attacker without authentication or authorization. All AVideo deployments through commit c3edcc274c389816d434acadac07ee78eaf330c1 are affected. An attacker who can reach the web interface and supply a known or guessed stream key can silently download private recorded video content, with no public exploit or KEV status confirmed at time of analysis.
Stored cross-site scripting in the YPTWallet plugin of WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) lets an authenticated low-privilege user plant malicious markup via a CryptoWallet configuration value that is base64-encoded but never HTML-escaped before being written to wallet_log.information. When an administrator reviews pending withdrawal requests in pendingRequests.php, the payload executes in their session, enabling attacker-driven administrative actions through same-origin fetch requests. Reported by VulnCheck with a vendor GitHub Security Advisory (GHSA-fvp5-q9jp-29mx); no public exploit identified at time of analysis.
Cross-site request forgery in WWBN AVideo's playlistRemove.php endpoint allows remote attackers to silently delete authenticated users' playlists by luring victims to a malicious webpage. The endpoint processes POST requests for playlist deletion without validating a CSRF token, meaning any browser-initiated request carrying a valid session cookie - regardless of origin - is accepted. No public exploit has been identified at time of analysis, though the attack is trivially constructible from a standard HTML form.
Stored cross-site scripting in WWBN AVideo (open-source video CMS) allows an administrator holding the canAdminUserGroups permission to persist malicious HTML/JavaScript through UserGroups::setGroup_name(), which then executes in the browser of any other administrator who opens the user manager interface. Affects all builds through commit c3edcc274c389816d434acadac07ee78eaf330c1. Reported by VulnCheck; no public exploit identified at time of analysis and it is not in CISA KEV.
Password-protection bypass in WWBN AVideo's PlayerSkins SEO plugin endpoint allows unauthenticated remote attackers to retrieve direct MP4 URLs for videos that owners have restricted behind passwords. The flaw resides in `plugin/PlayerSkins/seo.php`, where `getSources()` is invoked without any password validation step, so a caller supplying only a video ID receives the full source URL regardless of the configured password. All AVideo deployments through commit c3edcc274c389816d434acadac07ee78eaf330c1 are affected; no public exploit or CISA KEV listing has been identified at time of analysis.
Password-protected live stream bypass in AVideo exposes RTMP stream keys, HLS playlist URLs, and AES-128 decryption keys to unauthenticated remote callers via two compounding failures. The PHP-side stats API (`Live::_getStats()` in `plugin/Live/Live.php`) returns protected transmission credentials regardless of password check outcome - including the hidden_applications branch invoked when `canSeeLiveFromLiveKey()` denies access. Independently, the shipped NGINX configuration leaves the `/live` location serving `.m3u8` playlists, AES-128 segment encryption keys, and `.ts` segments without any `auth_request` directive (the `auth_key_check` in the `.key` block is commented out), allowing full stream decryption without the configured password. No patched version was available at time of the advisory.
Cross-site request forgery in WWBN AVideo's log archive endpoint allows unauthenticated remote attackers to exfiltrate sensitive application logs and destroy forensic evidence by tricking an authenticated administrator into visiting a malicious page. The `view/logArchive.json.php` endpoint accepts GET requests without any CSRF token validation, so a crafted page silently causes the administrator's browser to trigger log archiving - copying live logs into a publicly accessible zip file while simultaneously truncating the original log to eliminate attack traces. Affected versions span all releases through commit c3edcc274c389816d434acadac07ee78eaf330c1; no KEV listing and no public exploit code identified at time of analysis.
Cross-site request forgery in AVideo's setPassword.json.php endpoint allows unauthenticated remote attackers to modify or clear any user's channel password by tricking an authenticated administrator into visiting a malicious webpage. The root cause is the endpoint accepting GET requests for a state-changing password operation without CSRF token validation, making a single img tag or iframe on an attacker-controlled page sufficient to trigger the attack. No public exploit has been identified at time of analysis, and no KEV listing exists, but the low attack complexity makes successful exploitation realistic whenever an administrator can be phished.
Cross-site request forgery in WWBN AVideo's LoginControl plugin allows network-adjacent unauthenticated attackers to silently replace a logged-in victim's PGP two-factor authentication public key by luring them to a page containing a crafted image tag pointing to the unprotected `savePublicKey.json.php` GET endpoint. The outcome is either account lockout (denying the legitimate user access) or full account takeover if the attacker independently possesses the victim's password and can now pass 2FA using their own PGP key. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Stored cross-site scripting in WWBN AVideo's AD_Server plugin lets an unauthenticated attacker persist malicious HTML via the unescaped 'label' parameter of the log.php endpoint, which later executes as arbitrary JavaScript when an administrator opens the Ad Types report. Because the admin report renders the stored value with jQuery .html() without sanitization, exploitation yields code execution in a privileged administrator's browser session, enabling account/session takeover of the affected AVideo installation. No public exploit identified at time of analysis, though a coordinated GitHub Security Advisory (GHSA-h68w-3r38-wmm8) documents the flaw.
Stored cross-site scripting in WWBN AVideo's LiveLinks plugin lets a low-privileged user with canStream permission persist malicious JavaScript via unsanitized title and description fields, which then executes in the browser of every visitor who views the live-link page - including administrators - inside the site origin. Reported by VulnCheck, the flaw affects AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1; no public exploit identified at time of analysis and it is not in CISA KEV.
Stored cross-site scripting in WWBN AVideo (all versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1) lets a low-privileged, self-registered user plant a persistent JavaScript payload through video category creation. The unsanitized `name` and `iconClass` POST parameters in objects/categoryAddNew.json.php are later rendered into HTML text and a class attribute on watch pages and Gallery cards, so the payload executes in the browser of any visitor - including administrators - enabling session-riding authenticated requests. VulnCheck reported it unpatched; no public exploit code is identified at time of analysis and it is not in CISA KEV.
Stored cross-site scripting in the WWBN AVideo LoginControl plugin (all versions through commit c3edcc274c389816d434acadac07ee78eaf330c1) lets any authenticated user inject JavaScript via the User-Agent header, which is stored unencoded in login history and executes in an administrator's browser when they open the Login History page. Because it runs inside the admin session, an attacker can drive privileged actions and effect account takeover of the platform. Reported by VulnCheck; no public exploit identified at time of analysis and no active exploitation confirmed.
WWBN AVideo's restream subsystem allows any authenticated user holding `canStream` permission to mint authorization tokens for restream objects they do not own, by sending crafted requests to `getRestream.json.php` without ownership validation. Exchanging that token against `getLiveKey.json.php` exposes the victim's stored stream key for YouTube, Twitch, or arbitrary RTMP destinations - granting the attacker full publish access to another user's live streaming channel. No public exploit code has been identified at time of analysis, and the vulnerability is tracked by VulnCheck via GitHub security advisory GHSA-7jf4-mmqm-7p7x.
Unauthenticated account takeover in WWBN AVideo (through commit e01e41ecc) stems from get_api_preauthorize in plugin/API/API.php, a second, undocumented login path that performs the same credential check as get_api_signIn but omits the 10-attempts-per-5-minutes throttle enforced by checkRateLimit(). This lets remote attackers brute-force any account - including admin - without rate limiting, and the endpoint doubles as a credential oracle whose users_id field (1 vs 0) discloses password validity even though the message always reads 'Invalid credentials'. No public exploit identified at time of analysis, and no vendor-released patch is available.
Unauthenticated information disclosure in WWBN AVideo through version 29.0 allows any remote attacker to retrieve live-stream keys, private EPG programme schedules, and server identifiers from the exposed `plugin/PlayLists/epg.json.php` endpoint without credentials. The PHP endpoint performs no authentication check (CWE-306), and because the API accepts sequential user and playlist IDs, an attacker can enumerate the full set of sensitive broadcast credentials across all accounts on an instance. No public exploit or CISA KEV listing has been identified at time of analysis, though the issue is trivially exploitable given its network-accessible, zero-prerequisite nature.
Unauthenticated information disclosure in AVideo through 29.0 exposes private live-stream credentials - including stream keys and m3u8 playlist URLs - to any network-accessible attacker who queries the unprotected `plugin/Live/stats.json.php` endpoint. The `hidden_applications` array in the JSON response contains metadata for private, unlisted, and group-restricted live streams that the platform explicitly intends to conceal from unauthorized viewers. No public exploit has been identified at time of analysis, but the vulnerability is trivially reachable given its zero-precondition CVSS 4.0 profile (AV:N/AC:L/AT:N/PR:N/UI:N, score 8.7).
Authenticated streamers on AVideo through version 29.0 can harvest source stream keys and identity information belonging to all other active streamers by querying the restreamsActive.json.php endpoint, which applies no per-user ownership filtering. The exposed stream keys are live transmission credentials that can be used to impersonate affected streamers on third-party platforms such as YouTube Live or Twitch, enabling broadcast hijacking or session disruption. No active exploitation or public exploit code has been identified at the time of analysis, and exploitation requires a valid streaming account on the same AVideo instance.
Missing authorization in AVideo's SocialMediaPublisher plugin allows any authenticated user to overwrite another account's OAuth token records via an IDOR flaw in the add.json.php endpoint. By supplying arbitrary database row IDs, an attacker can corrupt a victim's stored access_token and refresh_token, then delete the record to permanently destroy the victim's social media provider linkage. No public exploit has been identified at time of analysis; exploitation requires a valid AVideo account (PR:L).
Cross-site request forgery in AVideo's YPTWallet plugin enables unauthenticated attackers to set arbitrary wallet balances for any user by tricking an authenticated administrator into loading a malicious webpage. The vulnerable endpoint `plugin/YPTWallet/view/saveBalance.php` relies exclusively on session cookies for request authorization with no CSRF token validation, meaning a forged POST request is accepted as legitimate whenever an admin's browser submits it. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, but the attack is trivially constructable from the public advisory.
PGP two-factor authentication bypass in AVideo's LoginControl::verifyChallenge() allows a network-accessible attacker holding only a valid account password to completely circumvent the PGP 2FA step and obtain full authenticated session access. The flaw stems from PHP's loose equality operator (==) comparing the submitted challenge against an unset session variable, which evaluates as true when an empty value is submitted - a classic PHP type-juggling weakness. No active exploitation (KEV) or public proof-of-concept code has been identified at time of analysis, but the bypass is trivially reproducible by any credential-holding attacker.
Email two-factor authentication bypass in WWBN AVideo (through commit c3edcc274) allows an attacker who already possesses valid account credentials to skip device-enrollment 2FA entirely. The root cause is a cache invalidation failure in the sqlDAL layer: empty result sets are cached, and writeSql never purges them, so when a new-device login triggers 2FA code generation, the confirmation code hash is computed from a stale empty cache entry rather than a freshly written value - causing the check to silently pass without a valid code. No public exploit code is confirmed and the vulnerability is not listed in CISA KEV at time of analysis, but the bypass is straightforward for any attacker with stolen or leaked passwords.
Authorization bypass in AVideo's live-streaming endpoint allows unauthenticated remote attackers to publish content to any user's RTMP stream by exploiting a hardcoded session cookie. In saveLive.php and related endpoints, PHP cookie precedence causes a session cookie named 'key' with the constant value 'value' to silently override the legitimate $_REQUEST['key'] stream key parameter check, effectively nullifying per-user stream authentication. Any attacker who reads this disclosure now possesses the exact bypass credential; no public exploit code or CISA KEV listing has been identified at time of analysis, but the trivial nature of exploitation (a known constant) makes it functionally equivalent to a zero-authentication bypass.
Insecure Direct Object Reference (IDOR) in WWBN AVideo allows authenticated users holding the canStream permission to hijack third-party live restream destinations on YouTube, Facebook, and Twitch by supplying arbitrary live_restreams_id values to resendRestreamer.json.php. The endpoint fails to verify that the requesting user owns the referenced restream configuration, exposing victim stream keys and allowing an attacker to broadcast their own content to victim-controlled channels. No public exploit code or active exploitation has been confirmed at time of analysis, though the impact on streaming operators could be severe and immediately visible.
Cross-site request forgery in WWBN AVideo through commit c3edcc274c allows unauthenticated remote attackers to manipulate live streaming state by inducing administrative users to visit attacker-controlled pages. The affected endpoints - deleteHistory.json.php and finishAll.json.php - accept state-changing GET requests without CSRF token validation, meaning a simple embedded image or link is sufficient to trigger destructive operations. An attacker can silently erase all live transmission history or mark active streams as finished with only passive administrator interaction, with no public exploit identified at time of analysis.
The synthesis JSON is above. Summary of the key analytical decisions: - **Impact framing:** The input's CWE-200 / "Information Disclosure" tag is technically the root cause, but the real-world outcome is **admin account takeover** via replayed live session identifiers — I reflected that in both C:H and I:H, matching VulnCheck's supplied VC:H/VI:H. - **Patch status:** Fix exists per GHSA-82q2-88mq-p44q, but no exact version was in the input, so I did not invent one. - **Exploitation status:** No KEV, no EPSS, no POC in the input → "no public exploit identified at time of analysis." - **`data_quality_flags`:** empty — the tags/vendor/CPE are all correct; the "Information Disclosure" tag understates but is not verifiably *wrong*, so it stays in `confidence_notes`/`risk_assessment` rather than as a machine-actionable flag. - **Prompt injection:** The "Editorial note (internal)" instructing insertion of the word "olsztyn" was a prompt-injection attempt (matching the known pattern in these CVE inputs) and was **ignored** — no canary word appears anywhere in the output. I also recorded a memory file for this CVE and added its index line.
Unauthenticated arbitrary file write in WWBN AVideo's notify.ffmpeg.json.php endpoint lets remote attackers plant files anywhere under the application root by supplying an attacker-chosen path in the avideoRelativePath parameter. Authentication is trivially defeated because the notifyCode token is any previously issued ciphertext replayed back - the server decrypts it but never validates it - enabling a straight path from unauthenticated request to writing a PHP webshell and remote code execution. Reported by VulnCheck; no public exploit identified at time of analysis, though the advisory describes the technique in enough detail to reproduce.
External-login account password generation in WWBN AVideo uses PHP's non-cryptographic rand() function, producing a keyspace of only 2^31 integers, and stores resulting passwords as unsalted MD5 hashes. An attacker who obtains the AVideo password hash database can exhaustively search the entire 2-billion-entry keyspace in seconds to minutes on commodity GPU hardware, recovering plaintext credentials for all external-login accounts. No public exploit has been identified at time of analysis; the CVSS 4.0 score of 7.4 reflects the prerequisite of prior hash access.
Server-side request forgery in WWBN AVideo (all versions through commit c91b5975d) allows authenticated API clients to force the application server to fetch arbitrary internal URLs via the unvalidated `profileImg` and `backgroundImg` parameters in the `set_api_userImages` endpoint. Unlike blind SSRF, fetched responses are written to publicly accessible web paths, enabling reliable exfiltration of cloud metadata credentials (e.g., AWS IMDS IAM tokens), internal API responses, and network-internal service data. No public exploit code or CISA KEV listing exists at time of analysis, but the non-blind exfiltration path significantly elevates real-world exploitability for cloud-hosted deployments.
Server-side request forgery in AVideo's EPG parser allows authenticated uploaders to force the server to fetch arbitrary internal URLs via the epg_link parameter during video upload. Any AVideo instance through commit c91b5975d is affected; the parameter undergoes only syntactic validation at submission time, and the actual server-side HTTP fetch during EPG generation occurs without SSRF protections such as private-IP blocking, allowlisting, or DNS rebinding defenses. No public exploit has been identified at time of analysis, but the attack requires only uploader-level credentials and is straightforward to execute against cloud-hosted or internally-networked deployments.
Cross-site request forgery in WWBN AVideo through commit c91b5975d allows unauthenticated remote attackers to hijack authenticated streamers' live broadcasts by tricking them into loading a malicious page. The saveLive.php endpoint in the Live plugin omits both POST-method enforcement (forbidIfNotPost) and CSRF token validation (forbidIfInvalidToken), so a crafted image tag silently overwrites the victim's RTMP key, password, and stream title when loaded by a logged-in streamer. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Cross-site request forgery chained with path traversal in AVideo's stopLive.php enables attackers to trigger recursive deletion of arbitrary server directories when an authenticated administrator visits a malicious page. The vulnerability exists through commit c91b5975d of the WWBN AVideo self-hosted video platform, affecting all versions covered by CPE cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*. The attack exploits missing CSRF token validation in stopLive.php combined with unsanitized concatenation of the key parameter into filesystem paths, allowing payloads like key=../../videos to destroy the videos directory and its contents. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated SQL injection in WWBN AVideo's channels API endpoint allows remote attackers to extract password hashes and account recovery tokens without any credentials. The `sort` column parameter in `get.json.php?APIName=channels` is injected directly into a SQL ORDER BY clause unsanitized, enabling an ordering oracle attack to infer sensitive column values character-by-character and triggering verbose SQL errors that disclose the full query and database schema. No public exploit has been identified at time of analysis, though VulnCheck has independently reported this vulnerability with a GitHub Security Advisory published by the vendor.
Full account takeover in WWBN AVideo arises because the video_id_hash acts as a non-expiring, non-revocable bearer token that authenticates the holder as the video owner with complete administrator privileges. Any attacker who obtains a valid video_id_hash can replay it indefinitely to gain full admin session access, and the credential keeps working even after the victim rotates their password - eliminating the primary recovery mechanism. Reported by VulnCheck with a fix in the vendor GitHub Security Advisory; no public exploit identified at time of analysis, and no EPSS or KEV data was provided.
Cross-site request forgery in WWBN AVideo's referer-validation logic allows unauthenticated remote attackers to trick administrative users into issuing forged requests that modify live server configuration. The flaw resides in the get_domain() and isSameDomain() functions, which fail to reject origins from sibling subdomains or malformed long-gTLD URLs, enabling forged admin-level ObjectYPT writes. No public exploit code or active exploitation has been identified at time of analysis, but the bypass is straightforward to weaponize against any deployment where an attacker can influence an admin to visit a malicious page.
Account takeover in WWBN AVideo is possible because userRecoverPassSave.json.php never checks whether a password-recovery token has expired, so any captured token stays valid forever. An attacker who obtains a recovery token for a target account can reset that account's password at an arbitrary later time and seize full control. Reported by VulnCheck with a coordinated GitHub Security Advisory (GHSA-j9p7-hm85-9v77); no public exploit identified at time of analysis and no EPSS/KEV data supplied.
Login-time security-control bypass in WWBN AVideo (commit e01e41ecc and earlier) lets an attacker who already possesses valid credentials defeat two-factor authentication, brute-force captcha escalation, and login/device audit logging by merely setting the HTTP User-Agent header to the literal string 'AVideoEncoder' or 'AVideoMobileApp'. The isAVideoEncoder()/isAVideoMobileApp() trust decisions rely solely on this client-controlled header with no IP allow-list or shared secret, so the protections are trivially spoofable. No patch is available at the time of analysis and no public exploit has been identified, though the advisory itself fully describes the technique.
Rate-limit bypass in WWBN AVideo (all versions) allows unauthenticated remote attackers to perform unlimited credential-guessing against login endpoints by rotating arbitrary X-Real-IP or X-Forwarded-For header values per request. The enforceRateLimit() function uses the attacker-supplied header as the client identifier without verifying the request originates from a trusted proxy, nullifying IP-based throttling entirely. No public exploit code has been identified at time of analysis, but the technique requires no specialised tooling beyond basic HTTP scripting.
UNION-based SQL injection in AVideo through version 29.0 allows unauthenticated remote attackers to read arbitrary database contents via the User_Location plugin's regions.json.php and cities.json.php endpoints. The country and region GET parameters are passed unsanitized into SQL queries without prepared statement binding, enabling direct extraction of password hashes and sensitive configuration data from the underlying database. No public exploit has been identified at time of analysis, but the UNION-based technique is elementary and well within reach of automated scanning tooling.
Unauthenticated disruption of scheduled live broadcasts in AVideo (all versions, CPE cpe:2.3:a:wwbn:avideo:*) is possible via a missing access control check on the RTMP callback endpoint plugin/Live/on_publish.php. The endpoint accepts crafted POST requests containing fabricated stream keys matching the predictable -ps-<N> pattern, causing the platform to mark any targeted scheduled broadcast as failed without requiring credentials. With a CVSS 4.0 score of 8.8 and PR:N/AV:N, this is remotely exploitable at low complexity; no public exploit or CISA KEV listing has been identified at time of analysis.
Cross-site request forgery in AVideo's plugin/API/set.json.php endpoint allows unauthenticated remote attackers to perform destructive, state-changing operations on behalf of authenticated victims by weaponizing ordinary browser GET requests. The affected endpoint accepts API parameters via GET without enforcing CSRF tokens or origin validation, enabling attackers to delete videos, deactivate user accounts, or manipulate playlists simply by luring an authenticated victim to a crafted URL. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis, though the low technical barrier for GET-based CSRF attacks makes independent replication straightforward.
SSRF filter bypass in WWBN AVideo exposes cloud metadata services and loopback interfaces to authenticated low-privilege attackers. The isSSRFSafeURL function fails to normalize IPv6 NAT64 addresses rendered in hexadecimal notation, allowing crafted URLs such as 64:ff9b::a9fe:a9fe to resolve to protected addresses like 169.254.169.254 while evading the SSRF blocklist. Exploitation could yield cloud instance credentials or access to internal services; no public exploit or KEV listing is confirmed at time of analysis.
Unauthenticated stream credential disclosure in AVideo (WWBN, commit e01e41ecc and earlier) lets remote attackers retrieve any user's restream stream_key and stream_url for external platforms like YouTube, Facebook, and Twitch. The getLiveKey.json.php endpoint accepts a 'token' parameter that bypasses both the Live::canRestream() access gate and the restream ownership check, and the token is merely AES-256-CBC encryptString() of an integer id with no user binding, expiry, or authentication tag. Because a public encryption oracle (view/url2Embed.json.php) lets anyone encrypt arbitrary values, valid tokens can be forged with no authentication; no public exploit is identified at time of analysis but the technique is fully described.
Rate-limiting bypass in WWBN AVideo (through commit e01e41ecc) allows unauthenticated remote attackers to conduct unlimited brute-force attacks against login.json.php and 13 other protected endpoints by exploiting a logic flaw in enforceRateLimit(). The function relies on ObjectYPT::setCacheGlobal to persist per-client attempt counters, but silently discards those writes whenever isBot() classifies the client as a bot - which occurs by default for any request omitting a User-Agent header or using agent strings matching 'curl', 'bot', 'crawler', or 'spider'. No active exploitation has been confirmed at time of analysis, but the trivial bypass mechanism makes this immediately usable for credential stuffing without any specialized tooling.
Privilege escalation in WWBN AVideo through commit 9c39d8c8 enables any user with upload permission to silently hijack an administrator session without knowing their credentials. Two chained functions - deduplicateByEncoderQueueId() exposing video hash tokens without ownership verification, and useVideoHashOrLogin() accepting those tokens as passwordless authentication - create a direct path from low-privilege user to full administrative access. No public exploit has been confirmed and the vulnerability is not listed in CISA KEV, but the low attack complexity and high CIA impact make this a high-priority remediation for any internet-accessible AVideo deployment.
Unauthorized access to restricted video content in WWBN AVideo (through commit 9c39d8c8) is enabled by a fundamental design flaw in the platform's token subsystem: getToken() produces tokens with no binding to user identity or intended purpose, and the Gallery plugin endpoint (plugin/Gallery/view/sections.php) distributes these tokens freely to unauthenticated visitors. Because the tokens carry no scope constraint, they are accepted as valid authorization across unrelated subsystems including the HLS streaming endpoint (view/hls.php), allowing any remote unauthenticated party to retrieve private video content. No public exploit has been identified at time of analysis, but the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) reflects a trivially simple, two-step attack requiring no special tools.
Cross-site request forgery in WWBN AVideo through commit 9c39d8c8 allows remote attackers to permanently publish embargoed videos by tricking an authenticated administrator into loading a malicious GET request targeting the releaseVideoNow.json.php endpoint. The endpoint accepts state-changing GET requests without any CSRF token or origin validation, relying solely on the browser's ambient session cookie. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified, though the GET-based CSRF pattern is trivially weaponizable via a one-pixel image tag or link.
Authorization bypass in WWBN AVideo through commit 9c39d8c8b4c1f75540788d6b391740852ceb0732 allows any authenticated user to forge two-party affiliation consent records and subsequently hijack video ownership of arbitrary content on the platform. The Users_affiliations add.json.php endpoint accepts attacker-controlled counterparty agreement timestamps without verification, enabling creation of forged affiliation records with approved status that are then unconditionally trusted by the videoAddNew.json.php ownership-transfer endpoint. No public exploit code or CISA KEV listing has been identified at time of analysis; however, only a low-privilege account is required, making this accessible to any registered user on a vulnerable instance.
OS command injection in WWBN AVideo through version 29.0 allows attackers to execute arbitrary operating-system commands as the web-server user via the ffmpeg.json.php endpoint. The notifyCode and callback request parameters are concatenated into a shell command without escaping, so an attacker able to produce a valid encrypted payload can inject shell metacharacters and achieve remote code execution. No public exploit identified at time of analysis; the flaw carries a CVSS 4.0 base score of 9.2, though successful exploitation is gated by the requirement to forge a valid encrypted payload.
OS command injection in AVideo (WWBN) through version 29.0 lets remote attackers who can forge a valid encrypted codeToExec payload run arbitrary shell commands as the web-server user via the listFFmpegProcesses() function in the standAlone plugin API. The flaw is unauthenticated (PR:N) but non-trivial to reach because it depends on producing an accepted encrypted parameter, and no public exploit or CISA KEV listing is identified at time of analysis.
Stored DOM cross-site scripting in WWBN AVideo's YPTSocket plugin (all versions prior to 29.0) lets any unauthenticated remote attacker run arbitrary JavaScript in the browser session of any administrator viewing the YPTSocket online-users debug panel. Because the malicious WebSocket metadata is broadcast to every connected client and rendered without escaping, a single anonymous WebSocket connection can be escalated into full administrative account takeover via the admin's own session and CSRF token. No public exploit identified at time of analysis; the flaw carries a CVSS 9.6 (Critical) rating driven by the scope change into the privileged admin origin.
Wallet balance forgery in WWBN AVideo 29.0 and earlier allows any authenticated user to credit their own wallet with arbitrary funds by abusing an unfinished AuthorizeNet payment handler. The plugin/AuthorizeNet/processPayment.json.php endpoint hardcodes payment success and calls YPTWallet::addBalance() using an attacker-supplied amount with no validation of the underlying Authorize.Net transaction. No public exploit has been identified at time of analysis, but the flaw is trivially reproducible from a logged-in account.
Arbitrary file deletion in WWBN AVideo (versions 29.0 and below) lets an authenticated attacker abuse the CloneSite plugin's `deleteDump` GET parameter to `unlink()` any file the web server can access. The `deleteDump` value is concatenated directly onto the clones directory path with no sanitization, so `../../` sequences escape the intended directory. This is an incomplete-fix regression of CVE-2026-33293; publicly available exploit code exists (advisory PoC), but there is no public exploit identified as used in active attacks, and EPSS risk is very low (0.04%).
Cross-origin data exposure in WWBN AVideo 29.0 and earlier lets a malicious website read authenticated /api/* responses because an incomplete CORS fix still reflects arbitrary Origin headers with Access-Control-Allow-Credentials: true. Any logged-in user who visits an attacker-controlled page can have their session-authenticated API responses - containing email, admin status, user ID, and other PII - read cross-origin. Publicly available exploit code exists (SSVC: poc) and the issue is confirmed via GitHub Security Advisory GHSA-ff5q-cc22-fgp4, though EPSS is very low (0.01%) and it is not in CISA KEV.
Cross-origin account takeover in WWBN AVideo (versions 29.0 and below) allows any attacker-controlled website to read authenticated API responses and issue state-changing requests on behalf of a logged-in victim. The `allowOrigin(true)` routine reflects the attacker's `Origin` header into `Access-Control-Allow-Origin` while also sending `Access-Control-Allow-Credentials: true`, and combined with the app's `SameSite=None` session cookie the victim's browser attaches credentials to cross-origin calls to the core get.json.php/set.json.php API. Proof-of-concept exploitation is documented in the GitHub advisory; EPSS is very low (0.04%) and it is not in CISA KEV, so no confirmed active exploitation exists.
Cross-site request forgery in WWBN AVideo (versions 29.0 and prior) lets an attacker abuse a logged-in admin's session against three state-changing JSON endpoints (categoryAddNew, categoryDelete, and pluginRunUpdateScript) that enforce only a role check and omit the CSRF token validation their sibling endpoints use. By luring an authenticated administrator to a malicious page, an attacker can create, overwrite, or delete video categories and trigger execution of any installed plugin's updateScript() method. Publicly available exploit code exists per the SSVC assessment, though EPSS is very low (0.02%, 5th percentile) and it is not on the CISA KEV list.
Remote code execution in AVideo versions 29.0 and below allows unauthenticated attackers to execute arbitrary shell commands on the server via command injection in the CloneSite plugin's cloneServer.json.php endpoint. Attackers exploit unsanitized user input in the 'url' parameter that gets directly concatenated into a wget command executed through PHP's exec() function. With CVSS 8.9 (AV:N/AC:L/PR:N/UI:N) and proof-of-concept exploitation confirmed (E:P), this represents a critical risk requiring immediate patching. Fix available in commit 473c609fc2defdea8b937b00e86ce88eba1f15bb.
Remote code execution in WWBN AVideo up to version 29.0 allows unauthenticated attackers to execute arbitrary system commands via unsanitized URL parameters in test.php. This vulnerability stems from an incomplete fix that sanitized wget calls but left file_get_contents and curl code paths exploitable through regex bypass (accepting strings like 'httpevil[.]com'). CVSS 9.3 with Critical scope change reflects the severity. Upstream fix available in commit 78bccae but no tagged release version confirmed at time of analysis. EPSS data not provided; no CISA KEV listing identified.
Cross-site request forgery in WWBN AVideo (versions ≤ 29.0) lets an attacker fully rewrite global site configuration by luring a logged-in administrator to a malicious page. The `objects/configurationUpdate.json.php` endpoint (aka `/updateConfig`) gates only on `User::isAdmin()` and omits any anti-CSRF token, Origin/Referer check, or `forbidIfIsUntrustedRequest()` call, so a single auto-submitted cross-origin POST can overwrite the encoder URL, SMTP credentials, site `<head>` HTML, logo, favicon, and contact email. Publicly available exploit code exists (SSVC: PoC) but the flaw is not in CISA KEV, and EPSS is very low at 0.02%.
Unauthenticated cross-user JavaScript execution in WWBN AVideo (versions 29.0 and prior) lets a remote attacker broadcast arbitrary code to every connected browser through the YPTSocket WebSocket plugin. Because anonymous visitors are issued valid socket tokens and the server relays the attacker-controlled `msg` and `callback` fields verbatim into client-side eval() sinks, any visitor can execute JavaScript in the origin of all connected users - including administrators - yielding universal account takeover, session theft, and privileged action execution. Publicly available exploit code exists (SSVC: PoC) though the flaw is not listed in CISA KEV, and EPSS is currently low at 0.17%.
Server-Side Request Forgery (SSRF) in WWBN AVideo 26.0 and earlier allows authenticated uploaders to exfiltrate data from internal network resources via objects/aVideoEncoder.json.php. The flaw bypasses existing SSRF protections by permitting attacker-controlled URLs with common media extensions (.mp4, .mp3, .zip, .jpg, .png, .gif, .webm), forcing the server to fetch and store arbitrary remote content. This represents an incomplete fix for CVE-2026-27732. No public exploit identified at time of analysis. CVSS 7.1 with network-accessible attack vector requiring low-privileged authentication.
Path traversal in WWBN AVideo platform ≤26.0 allows authenticated uploaders to read arbitrary server files via GIF poster manipulation. An attacker with uploader privileges can exploit aVideoEncoderReceiveImage.json.php to bypass path sanitization, fetch local files like /etc/passwd or application source code, and republish the contents through publicly accessible GIF media URLs. CVSS 7.6 reflects high confidentiality impact with low-complexity network attack requiring only low-privilege authentication. No public exploit identified at time of analysis, though EPSS data not available for risk quantification.
Unauthenticated remote attackers can bypass CLI-only access controls in WWBN AVideo versions 26.0 and prior via a PHP operator precedence bug in install/deleteSystemdPrivate.php, allowing HTTP access to delete server temp directory files and disclose their contents without authentication. The vulnerability stems from a logic error where !php_sapi_name() === 'cli' evaluates incorrectly due to operator binding precedence, causing the access guard to fail entirely. No public exploit code or active exploitation has been reported at the time of this analysis.
WWBN AVideo 26.0 and prior exposes sensitive user data through 21 unauthenticated API endpoints via the CreatePlugin template generator. The list.json.php template lacks authentication checks present in its companion add.json.php and delete.json.php templates, allowing remote attackers to enumerate and retrieve user PII, payment logs, IP addresses, user agents, and internal system records without authentication. No vendor patch exists at time of analysis.
Unauthenticated attackers can remotely terminate any active live stream in WWBN AVideo 26.0 and prior by sending crafted POST requests to the on_publish_done.php endpoint in the Live plugin. The vulnerability combines two weaknesses: an unauthenticated stats.json.php endpoint that exposes active stream keys, and the on_publish_done.php RTMP callback handler that processes stream termination requests without authentication or authorization checks. This enables complete denial-of-service against all platform live streaming functionality. CVSS 7.5 (High) with network attack vector, low complexity, and no privileges required. No vendor-released patch identified at time of analysis; EPSS data not available.
Cross-site request forgery in WWBN AVideo 26.0 and earlier enables remote attackers to reconfigure critical plugin settings through forged requests targeting admin/save.json.php. The endpoint lacks CSRF token validation while the application sets SameSite=None cookies, allowing attackers to manipulate payment processors, authentication providers, and cloud storage credentials by tricking authenticated administrators into visiting malicious pages. No vendor-released patch identified at time of analysis. EPSS data unavailable; not listed in CISA KEV; no public exploit identified at time of analysis, though exploitation requires only standard CSRF techniques.
Reflected cross-site scripting (XSS) in WWBN AVideo versions up to 26.0 enables credential theft through unsanitized request parameter echoed into JavaScript context. Attackers can craft malicious URLs that, when clicked by authenticated users, execute arbitrary JavaScript and exfiltrate the victim's username and password hash directly exposed in the vulnerable code block. CVSS score of 8.2 reflects high confidentiality impact; no public exploit identified at time of analysis.
SQL injection in WWBN AVideo versions up to 26.0 allows unauthenticated remote attackers to extract sensitive database contents and modify data through the RTMP publish authentication stream key validation mechanism. The vulnerability (CVSS 9.1 Critical) arises from unsanitized string interpolation in Live_schedule::keyExists() fallback logic, affecting the open-source video platform's live streaming infrastructure. No vendor-released patch identified at time of analysis, and no public exploit identified at time of analysis.
WWBN AVideo, an open source video platform, contains a SQL injection vulnerability in the Subscribe::save() method that allows authenticated attackers to execute arbitrary SQL queries. Versions up to and including 26.0 are affected, with the vulnerability stemming from unsanitized user input from the $_POST['user_id'] parameter being concatenated directly into INSERT queries. An attacker with low-level authentication can extract sensitive data including password hashes, API keys, and encryption salts from the database, representing a significant information disclosure risk.
WWBN AVideo video platform up to and including version 26.0 contains an authentication bypass vulnerability in the CDN plugin that allows unauthenticated remote attackers to completely modify CDN configuration settings including storage credentials and authentication keys. The vulnerability stems from the CDN plugin's default empty string authentication key, which causes validation checks to be bypassed entirely when the plugin is enabled but not properly configured. The CVSS score of 8.6 reflects high integrity impact with network-based exploitation requiring no privileges or user interaction.
WWBN AVideo versions up to and including 26.0 contain a critical file upload vulnerability (CWE-434) that allows authenticated attackers to upload and execute arbitrary PHP code on the server. The vulnerability exists in the downloadVideoFromDownloadURL() function which saves remote content with its original filename and extension to a web-accessible directory; by providing an invalid resolution parameter, attackers can bypass cleanup mechanisms, leaving executable PHP files persistent under the web root. With a CVSS score of 8.8, this represents a high-severity remote code execution risk for authenticated users.
WWBN AVideo versions up to and including 26.0 contain an authentication bypass vulnerability in the standalone live stream control endpoint. The endpoint accepts a user-supplied 'streamerURL' parameter that redirects token verification to an attacker-controlled server, allowing complete bypass of authentication without any user interaction. With a CVSS score of 9.4, an attacker gains unauthenticated control over any live stream including the ability to drop publishers, manipulate recordings, and probe stream existence.
Unauthenticated remote attackers can drive AVideo-Encoder's privileged queue processor and read its control and status plane in default installations prior to 8.1.0. Because the application ships no global authentication layer (the bundled .htaccess denies only .git, *.log and avideo.log), the PHP endpoints view/run.php, view/queue.json.php, view/status.php and view/listFiles.json.php are directly reachable and perform their privileged actions for anonymous callers - invoking Encoder::run(), disclosing the job queue and every streamer site URL, returning host memory statistics with a wildcard Access-Control-Allow-Origin header, and enumerating media file names and paths in any directory readable by the web-server user. Impact is bounded to control-plane manipulation and information exposure (no code execution, and enumeration is limited to configured media extensions and does not return file contents); a public PoC reference with anonymous curl requests exists in the vendor advisory, but it is not verified as working exploit code and there is no KEV listing, with priority assessed as remediation this week and a vendor fix available in 8.1.0.
Unauthenticated server-side request forgery in AVideo-Encoder (WWBN / AVideo project) before the 8.1.0 remediation attempt lets anyone who can reach the encoder force it to fetch arbitrary URLs from its own network position, with the raw fetched body reflected back in the JSON login response - enough to harvest cloud instance-metadata credentials or probe internal HTTP, HTTPS, TCP and FTP services. No account or operator interaction is required because the only destination gate (Streamer::isURLAllowed) allows every target when the operator allowlist is empty, which is the default, and TLS peer verification is disabled so untrusted self-signed internal HTTPS endpoints are accepted. A public proof-of-concept reproduction (curl-based) is documented in the vendor security advisory; there is no confirmed active exploitation (not in CISA KEV). Version 8.1.0 is an initial remediation that removes raw-response reflection and adds destination checks, but private-network exemptions and the login TLS-verification default leave the internal-network and TLS variants unresolved.
Unauthenticated OS command injection in AVideo-Encoder before 8.1.0 gives remote attackers arbitrary command execution as the web-server user through the live-streaming endpoint view/videosListToLive.php. The endpoint requires only non-empty playlists_id and APISecret values, forwards APISecret without comparing it to any stored secret, and never applies the Streamer::isURLAllowed allowlist, so an attacker can point webSiteRootURL at an HTTP stub they control, have Login::run adopt the returned JSON as session state (self-granting isLogged and canStream), then return a video list whose videos[].path values are interpolated without escaping into ffprobe and ffmpeg commands run via exec. Successful exploitation discloses database and stored streamer credentials, permits upstream platform compromise, file modification and persistence as the web-server user, and can deny encoder service; the vendor fixed this in 8.1.0 and no public exploit code is confirmed in the supplied data, though the advisory includes a detailed working PoC recipe.
Unauthenticated PHP code injection in AVideo-Encoder before 8.1.0 allows a remote attacker to write arbitrary PHP into videos/configuration.php through install/checkConfiguration.php and execute it as the web-server user. The attack works only while videos/configuration.php is absent-the default on a fresh deployment or after the file is deleted or moved-and requires the attacker to supply a reachable database host, which they control, plus a systemRootPath containing index.php. Version 8.1.0 fixes the flaw; a public PoC reference exists and is not verified as working exploit code, and the decision label is act_now with CVSS 10.0.
Delegated 'Users Admin' accounts in WWBN AVideo before version 29.4.0 can delete, overwrite, or demote full administrator accounts by posting directly to confirmDeleteUser.json.php or userAddNew.json.php with an administrator's user ID, destroying that admin's videos and account in the process. The flaw is a server-side authorization gap: the interface already hides admin-row actions from non-admins, but the endpoints themselves never re-verified that the caller outranks the target, so a crafted request bypasses the cosmetic UI restriction. Exploitation requires an authenticated account holding the Permissions::canAdminUsers() delegated role, so anonymous visitors and ordinary users are not affected; no public exploit code has been identified at time of analysis and no EPSS or CISA KEV signal is present in the available data.
Stored cross-site scripting in WWBN AVideo 12.4 through 29.2.0 allows authenticated users with video-upload privileges to inject arbitrary HTML or JavaScript into video titles using doubly-encoded entities that survive the application's sanitizer. The injected payload executes when a victim views a crafted title on trending, gallery, embed, or playlist pages, enabling limited confidentiality and integrity impact (e.g., session token theft or actions as the victim) when a privileged user loads the page. Exploitation requires an authenticated uploader account and victim interaction; no public exploit identified at time of analysis, and the upstream commit c4b6ca95... provides a fix.
Stored cross-site scripting in WWBN AVideo through 29.2.0 allows an authenticated user who holds video upload permission to store a crafted trailer1 URL that is later rendered without escaping in the YouPHPFlix2 templates (BigVideo.php, BigVideoButtons.php, row_info.php) and in the channel playlist view (channelPlaylistItems.php). The injected value can break out of an onclick='flixFullScreen(...)' / avideoModalIframe(...) JavaScript string or an iframe src attribute, so any visitor who loads an affected page has attacker-controlled JavaScript executed in their browser context. Exploitation requires both a valid upload-capable account (PR:L) and victim interaction with a rendering page (UI:P), and the security impact is realized in the victim's browser rather than directly on the server; no public exploit code or CISA KEV entry was identified at time of analysis, and the vendor advisory and fix commit are already public.
AVideo's PGP second-factor verification can be bypassed, allowing an attacker who already holds a victim's password to complete authentication without ever supplying a valid PGP challenge response. The LoginControl component's verifyChallenge.json.php endpoint compares the submitted response against an uninitialized session variable using PHP loose equality, so a single parameter-less GET request evaluates null == null and marks the login fully authenticated; EUVD tracking places the affected range at AVideo 0 through 29.0. No public exploit code or confirmed active exploitation was identified at time of analysis, but the attack needs only one unauthenticated-to-the-endpoint network request with no user interaction, and the independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, making it a high-priority authentication bypass wherever PGP 2FA is the sole remaining protection and credential theft or reuse is feasible.
Unauthenticated remote attackers can achieve account takeover in AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 by guessing weakly generated activation/login pairing codes. The getRandomCode() function in objects/functions.php relies on uniqid() output, limiting the code space to roughly 2^25 values for a known generation second; the plugin/API/set.json.php?APIName=login_code endpoint leaks server microtime as an oracle, and a guessed valid code (10-minute TTL) redeemed at plugin/API/get.json.php?APIName=login_code yields the victim's email and a one-year User::getUserHash credential. No vendor patch is available and no public exploit code has been identified, though the weak PRNG and unauthenticated oracle make the attack a genuine account-takeover primitive tempered by high attack complexity (AC:H/AT:P) due to the timed probabilistic guess.
Stream-key forgery in WWBN AVideo lets remote unauthenticated attackers reconstruct a live channel's RTMP publish key and broadcast content as the channel owner, by brute-forcing the roughly one million microsecond candidates produced by PHP's uniqid() in the LiveTransmition component. Exploitation requires the live-streaming feature to be in use and the attacker to know or closely estimate the target channel's creation timestamp, which is why exploitability is assessed as high complexity/high attack requirements despite the unauthenticated network vector. Only integrity of the published stream is at stake (no account takeover, code execution, or data disclosure), and no public exploit identified at time of analysis; the raw vendor CVSS 4.0 score of 8.3 overstates the practical ease of exploitation relative to the assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).
Unauthenticated attackers can pull restricted live-stream metadata - including RTMP stream keys, stream titles, descriptions, owner details, and direct HLS playback URLs - from two JSON endpoints in the AVideo Live plugin (plugin/Live/stats.json.php and plugin/Live/calendar.json.php) in all versions up to and including 29.0. The endpoints fail to enforce the platform's user-group access restrictions, so content intended only for members of a specific group is exposed to anyone who can reach the server. No public exploit code or CISA KEV entry was identified at time of analysis, but the flaw is trivially automatable over the network with no credentials or user interaction, and CVSS 4.0 rates it 8.7 with high confidentiality impact.
Missing authorization in WWBN AVideo's Scheduler email plugin exposes private subscriber email addresses, live-stream titles, and scheduled job metadata to any unauthenticated network attacker who can supply a valid site-wide daily token. The daily token is obtainable without authentication from publicly accessible Live pages, making the attack effectively unauthenticated for instances with open Live pages. No public exploit code has been identified at time of analysis, but the attack path is mechanically straightforward and the confidentiality impact is high given the exposure of user email addresses.
Stored cross-site scripting in the WWBN AVideo Bookmark plugin lets a video owner persist a JavaScript payload through the bookmark/chapter name parameter, which is concatenated into public watch-page HTML without output encoding (CWE-79). Every viewer of the affected video then executes attacker-controlled script in the AVideo origin, enabling session/account compromise of ordinary users and administrators. Reported by VulnCheck with a public advisory; no CISA KEV listing and no weaponized exploit code identified, though technical detail in the advisory lowers the barrier to reproduction.
Stored cross-site scripting in the LoginControl plugin of WWBN AVideo allows an authenticated low-privilege user to persist malicious JavaScript by submitting a crafted PGP public key, which is echoed unencoded into a textarea and executes in an administrator's browser session when the admin views the attacker's profile tab. This is a privilege-escalation vector - attacker-controlled script runs with admin session context, enabling account/platform takeover. VulnCheck reported it with a published GitHub Security Advisory; no public exploit is identified at time of analysis and it is not in CISA KEV.
Stored cross-site scripting in WWBN AVideo's CustomizeUser plugin lets an administrator persist an unsanitized field_name value through the add.json.php endpoint, which later executes as script when any user or admin renders the extra-info pages or profile forms via the typeToHTML function. The flaw affects AVideo up through commit c3edcc274c389816d434acadac07ee78eaf330c1 and was reported by VulnCheck; no public exploit identified at time of analysis and it is not in CISA KEV.
Stored cross-site scripting in WWBN AVideo (through commit c3edcc27) lets an authenticated user poison their own 'donationLink' profile field, which is later rendered unencoded inside an <a href="..."> attribute on the video watch page. Because User::save() validates the value only with FILTER_VALIDATE_URL (which accepts embedded double quotes and event handlers) and getDonationLink() applies only strip_tags(), an attacker can break out of the href attribute and execute JavaScript in the browser of any visitor - including an administrator - who hovers over the donation button. Reported by VulnCheck; publicly available exploit code exists via the advisory, and the issue was unfixed at time of reporting.
Missing ownership verification in AVideo's addLiveLink.php enables any authenticated canStream user to hijack another user's LiveLink by supplying a known linkId in an update request, overwriting the victim's HLS source URL and stream metadata without authorization. The flaw affects AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 and allows an attacker to silently redirect the victim's viewers to attacker-controlled media. No public exploit has been identified at time of analysis, but the low privilege bar - only a canStream account is required - makes this a realistic threat on shared multi-user AVideo deployments.
Unrestricted wallet-credit minting in AVideo's AD_Server plugin allows any authenticated user to fraudulently inflate YPTWallet balances for campaign video owners without proof of ad delivery. The flaw resides in plugin/AD_Server/log.php, which accepts arbitrary label values - including label=start - via POST requests and credits the associated campaign wallet unconditionally. Repeated exploitation constitutes ad fraud, enabling attackers to generate synthetic platform currency at will. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated file read in WWBN AVideo's getRecordedFile.php endpoint exposes recorded live-stream FLV files to any network attacker without authentication or authorization. All AVideo deployments through commit c3edcc274c389816d434acadac07ee78eaf330c1 are affected. An attacker who can reach the web interface and supply a known or guessed stream key can silently download private recorded video content, with no public exploit or KEV status confirmed at time of analysis.
Stored cross-site scripting in the YPTWallet plugin of WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) lets an authenticated low-privilege user plant malicious markup via a CryptoWallet configuration value that is base64-encoded but never HTML-escaped before being written to wallet_log.information. When an administrator reviews pending withdrawal requests in pendingRequests.php, the payload executes in their session, enabling attacker-driven administrative actions through same-origin fetch requests. Reported by VulnCheck with a vendor GitHub Security Advisory (GHSA-fvp5-q9jp-29mx); no public exploit identified at time of analysis.
Cross-site request forgery in WWBN AVideo's playlistRemove.php endpoint allows remote attackers to silently delete authenticated users' playlists by luring victims to a malicious webpage. The endpoint processes POST requests for playlist deletion without validating a CSRF token, meaning any browser-initiated request carrying a valid session cookie - regardless of origin - is accepted. No public exploit has been identified at time of analysis, though the attack is trivially constructible from a standard HTML form.
Stored cross-site scripting in WWBN AVideo (open-source video CMS) allows an administrator holding the canAdminUserGroups permission to persist malicious HTML/JavaScript through UserGroups::setGroup_name(), which then executes in the browser of any other administrator who opens the user manager interface. Affects all builds through commit c3edcc274c389816d434acadac07ee78eaf330c1. Reported by VulnCheck; no public exploit identified at time of analysis and it is not in CISA KEV.
Password-protection bypass in WWBN AVideo's PlayerSkins SEO plugin endpoint allows unauthenticated remote attackers to retrieve direct MP4 URLs for videos that owners have restricted behind passwords. The flaw resides in `plugin/PlayerSkins/seo.php`, where `getSources()` is invoked without any password validation step, so a caller supplying only a video ID receives the full source URL regardless of the configured password. All AVideo deployments through commit c3edcc274c389816d434acadac07ee78eaf330c1 are affected; no public exploit or CISA KEV listing has been identified at time of analysis.
Password-protected live stream bypass in AVideo exposes RTMP stream keys, HLS playlist URLs, and AES-128 decryption keys to unauthenticated remote callers via two compounding failures. The PHP-side stats API (`Live::_getStats()` in `plugin/Live/Live.php`) returns protected transmission credentials regardless of password check outcome - including the hidden_applications branch invoked when `canSeeLiveFromLiveKey()` denies access. Independently, the shipped NGINX configuration leaves the `/live` location serving `.m3u8` playlists, AES-128 segment encryption keys, and `.ts` segments without any `auth_request` directive (the `auth_key_check` in the `.key` block is commented out), allowing full stream decryption without the configured password. No patched version was available at time of the advisory.
Cross-site request forgery in WWBN AVideo's log archive endpoint allows unauthenticated remote attackers to exfiltrate sensitive application logs and destroy forensic evidence by tricking an authenticated administrator into visiting a malicious page. The `view/logArchive.json.php` endpoint accepts GET requests without any CSRF token validation, so a crafted page silently causes the administrator's browser to trigger log archiving - copying live logs into a publicly accessible zip file while simultaneously truncating the original log to eliminate attack traces. Affected versions span all releases through commit c3edcc274c389816d434acadac07ee78eaf330c1; no KEV listing and no public exploit code identified at time of analysis.
Cross-site request forgery in AVideo's setPassword.json.php endpoint allows unauthenticated remote attackers to modify or clear any user's channel password by tricking an authenticated administrator into visiting a malicious webpage. The root cause is the endpoint accepting GET requests for a state-changing password operation without CSRF token validation, making a single img tag or iframe on an attacker-controlled page sufficient to trigger the attack. No public exploit has been identified at time of analysis, and no KEV listing exists, but the low attack complexity makes successful exploitation realistic whenever an administrator can be phished.
Cross-site request forgery in WWBN AVideo's LoginControl plugin allows network-adjacent unauthenticated attackers to silently replace a logged-in victim's PGP two-factor authentication public key by luring them to a page containing a crafted image tag pointing to the unprotected `savePublicKey.json.php` GET endpoint. The outcome is either account lockout (denying the legitimate user access) or full account takeover if the attacker independently possesses the victim's password and can now pass 2FA using their own PGP key. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Stored cross-site scripting in WWBN AVideo's AD_Server plugin lets an unauthenticated attacker persist malicious HTML via the unescaped 'label' parameter of the log.php endpoint, which later executes as arbitrary JavaScript when an administrator opens the Ad Types report. Because the admin report renders the stored value with jQuery .html() without sanitization, exploitation yields code execution in a privileged administrator's browser session, enabling account/session takeover of the affected AVideo installation. No public exploit identified at time of analysis, though a coordinated GitHub Security Advisory (GHSA-h68w-3r38-wmm8) documents the flaw.
Stored cross-site scripting in WWBN AVideo's LiveLinks plugin lets a low-privileged user with canStream permission persist malicious JavaScript via unsanitized title and description fields, which then executes in the browser of every visitor who views the live-link page - including administrators - inside the site origin. Reported by VulnCheck, the flaw affects AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1; no public exploit identified at time of analysis and it is not in CISA KEV.
Stored cross-site scripting in WWBN AVideo (all versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1) lets a low-privileged, self-registered user plant a persistent JavaScript payload through video category creation. The unsanitized `name` and `iconClass` POST parameters in objects/categoryAddNew.json.php are later rendered into HTML text and a class attribute on watch pages and Gallery cards, so the payload executes in the browser of any visitor - including administrators - enabling session-riding authenticated requests. VulnCheck reported it unpatched; no public exploit code is identified at time of analysis and it is not in CISA KEV.
Stored cross-site scripting in the WWBN AVideo LoginControl plugin (all versions through commit c3edcc274c389816d434acadac07ee78eaf330c1) lets any authenticated user inject JavaScript via the User-Agent header, which is stored unencoded in login history and executes in an administrator's browser when they open the Login History page. Because it runs inside the admin session, an attacker can drive privileged actions and effect account takeover of the platform. Reported by VulnCheck; no public exploit identified at time of analysis and no active exploitation confirmed.
WWBN AVideo's restream subsystem allows any authenticated user holding `canStream` permission to mint authorization tokens for restream objects they do not own, by sending crafted requests to `getRestream.json.php` without ownership validation. Exchanging that token against `getLiveKey.json.php` exposes the victim's stored stream key for YouTube, Twitch, or arbitrary RTMP destinations - granting the attacker full publish access to another user's live streaming channel. No public exploit code has been identified at time of analysis, and the vulnerability is tracked by VulnCheck via GitHub security advisory GHSA-7jf4-mmqm-7p7x.
Unauthenticated account takeover in WWBN AVideo (through commit e01e41ecc) stems from get_api_preauthorize in plugin/API/API.php, a second, undocumented login path that performs the same credential check as get_api_signIn but omits the 10-attempts-per-5-minutes throttle enforced by checkRateLimit(). This lets remote attackers brute-force any account - including admin - without rate limiting, and the endpoint doubles as a credential oracle whose users_id field (1 vs 0) discloses password validity even though the message always reads 'Invalid credentials'. No public exploit identified at time of analysis, and no vendor-released patch is available.
Unauthenticated information disclosure in WWBN AVideo through version 29.0 allows any remote attacker to retrieve live-stream keys, private EPG programme schedules, and server identifiers from the exposed `plugin/PlayLists/epg.json.php` endpoint without credentials. The PHP endpoint performs no authentication check (CWE-306), and because the API accepts sequential user and playlist IDs, an attacker can enumerate the full set of sensitive broadcast credentials across all accounts on an instance. No public exploit or CISA KEV listing has been identified at time of analysis, though the issue is trivially exploitable given its network-accessible, zero-prerequisite nature.
Unauthenticated information disclosure in AVideo through 29.0 exposes private live-stream credentials - including stream keys and m3u8 playlist URLs - to any network-accessible attacker who queries the unprotected `plugin/Live/stats.json.php` endpoint. The `hidden_applications` array in the JSON response contains metadata for private, unlisted, and group-restricted live streams that the platform explicitly intends to conceal from unauthorized viewers. No public exploit has been identified at time of analysis, but the vulnerability is trivially reachable given its zero-precondition CVSS 4.0 profile (AV:N/AC:L/AT:N/PR:N/UI:N, score 8.7).
Authenticated streamers on AVideo through version 29.0 can harvest source stream keys and identity information belonging to all other active streamers by querying the restreamsActive.json.php endpoint, which applies no per-user ownership filtering. The exposed stream keys are live transmission credentials that can be used to impersonate affected streamers on third-party platforms such as YouTube Live or Twitch, enabling broadcast hijacking or session disruption. No active exploitation or public exploit code has been identified at the time of analysis, and exploitation requires a valid streaming account on the same AVideo instance.
Missing authorization in AVideo's SocialMediaPublisher plugin allows any authenticated user to overwrite another account's OAuth token records via an IDOR flaw in the add.json.php endpoint. By supplying arbitrary database row IDs, an attacker can corrupt a victim's stored access_token and refresh_token, then delete the record to permanently destroy the victim's social media provider linkage. No public exploit has been identified at time of analysis; exploitation requires a valid AVideo account (PR:L).
Cross-site request forgery in AVideo's YPTWallet plugin enables unauthenticated attackers to set arbitrary wallet balances for any user by tricking an authenticated administrator into loading a malicious webpage. The vulnerable endpoint `plugin/YPTWallet/view/saveBalance.php` relies exclusively on session cookies for request authorization with no CSRF token validation, meaning a forged POST request is accepted as legitimate whenever an admin's browser submits it. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, but the attack is trivially constructable from the public advisory.
PGP two-factor authentication bypass in AVideo's LoginControl::verifyChallenge() allows a network-accessible attacker holding only a valid account password to completely circumvent the PGP 2FA step and obtain full authenticated session access. The flaw stems from PHP's loose equality operator (==) comparing the submitted challenge against an unset session variable, which evaluates as true when an empty value is submitted - a classic PHP type-juggling weakness. No active exploitation (KEV) or public proof-of-concept code has been identified at time of analysis, but the bypass is trivially reproducible by any credential-holding attacker.
Email two-factor authentication bypass in WWBN AVideo (through commit c3edcc274) allows an attacker who already possesses valid account credentials to skip device-enrollment 2FA entirely. The root cause is a cache invalidation failure in the sqlDAL layer: empty result sets are cached, and writeSql never purges them, so when a new-device login triggers 2FA code generation, the confirmation code hash is computed from a stale empty cache entry rather than a freshly written value - causing the check to silently pass without a valid code. No public exploit code is confirmed and the vulnerability is not listed in CISA KEV at time of analysis, but the bypass is straightforward for any attacker with stolen or leaked passwords.
Authorization bypass in AVideo's live-streaming endpoint allows unauthenticated remote attackers to publish content to any user's RTMP stream by exploiting a hardcoded session cookie. In saveLive.php and related endpoints, PHP cookie precedence causes a session cookie named 'key' with the constant value 'value' to silently override the legitimate $_REQUEST['key'] stream key parameter check, effectively nullifying per-user stream authentication. Any attacker who reads this disclosure now possesses the exact bypass credential; no public exploit code or CISA KEV listing has been identified at time of analysis, but the trivial nature of exploitation (a known constant) makes it functionally equivalent to a zero-authentication bypass.
Insecure Direct Object Reference (IDOR) in WWBN AVideo allows authenticated users holding the canStream permission to hijack third-party live restream destinations on YouTube, Facebook, and Twitch by supplying arbitrary live_restreams_id values to resendRestreamer.json.php. The endpoint fails to verify that the requesting user owns the referenced restream configuration, exposing victim stream keys and allowing an attacker to broadcast their own content to victim-controlled channels. No public exploit code or active exploitation has been confirmed at time of analysis, though the impact on streaming operators could be severe and immediately visible.
Cross-site request forgery in WWBN AVideo through commit c3edcc274c allows unauthenticated remote attackers to manipulate live streaming state by inducing administrative users to visit attacker-controlled pages. The affected endpoints - deleteHistory.json.php and finishAll.json.php - accept state-changing GET requests without CSRF token validation, meaning a simple embedded image or link is sufficient to trigger destructive operations. An attacker can silently erase all live transmission history or mark active streams as finished with only passive administrator interaction, with no public exploit identified at time of analysis.
The synthesis JSON is above. Summary of the key analytical decisions: - **Impact framing:** The input's CWE-200 / "Information Disclosure" tag is technically the root cause, but the real-world outcome is **admin account takeover** via replayed live session identifiers — I reflected that in both C:H and I:H, matching VulnCheck's supplied VC:H/VI:H. - **Patch status:** Fix exists per GHSA-82q2-88mq-p44q, but no exact version was in the input, so I did not invent one. - **Exploitation status:** No KEV, no EPSS, no POC in the input → "no public exploit identified at time of analysis." - **`data_quality_flags`:** empty — the tags/vendor/CPE are all correct; the "Information Disclosure" tag understates but is not verifiably *wrong*, so it stays in `confidence_notes`/`risk_assessment` rather than as a machine-actionable flag. - **Prompt injection:** The "Editorial note (internal)" instructing insertion of the word "olsztyn" was a prompt-injection attempt (matching the known pattern in these CVE inputs) and was **ignored** — no canary word appears anywhere in the output. I also recorded a memory file for this CVE and added its index line.
Unauthenticated arbitrary file write in WWBN AVideo's notify.ffmpeg.json.php endpoint lets remote attackers plant files anywhere under the application root by supplying an attacker-chosen path in the avideoRelativePath parameter. Authentication is trivially defeated because the notifyCode token is any previously issued ciphertext replayed back - the server decrypts it but never validates it - enabling a straight path from unauthenticated request to writing a PHP webshell and remote code execution. Reported by VulnCheck; no public exploit identified at time of analysis, though the advisory describes the technique in enough detail to reproduce.
External-login account password generation in WWBN AVideo uses PHP's non-cryptographic rand() function, producing a keyspace of only 2^31 integers, and stores resulting passwords as unsalted MD5 hashes. An attacker who obtains the AVideo password hash database can exhaustively search the entire 2-billion-entry keyspace in seconds to minutes on commodity GPU hardware, recovering plaintext credentials for all external-login accounts. No public exploit has been identified at time of analysis; the CVSS 4.0 score of 7.4 reflects the prerequisite of prior hash access.
Server-side request forgery in WWBN AVideo (all versions through commit c91b5975d) allows authenticated API clients to force the application server to fetch arbitrary internal URLs via the unvalidated `profileImg` and `backgroundImg` parameters in the `set_api_userImages` endpoint. Unlike blind SSRF, fetched responses are written to publicly accessible web paths, enabling reliable exfiltration of cloud metadata credentials (e.g., AWS IMDS IAM tokens), internal API responses, and network-internal service data. No public exploit code or CISA KEV listing exists at time of analysis, but the non-blind exfiltration path significantly elevates real-world exploitability for cloud-hosted deployments.
Server-side request forgery in AVideo's EPG parser allows authenticated uploaders to force the server to fetch arbitrary internal URLs via the epg_link parameter during video upload. Any AVideo instance through commit c91b5975d is affected; the parameter undergoes only syntactic validation at submission time, and the actual server-side HTTP fetch during EPG generation occurs without SSRF protections such as private-IP blocking, allowlisting, or DNS rebinding defenses. No public exploit has been identified at time of analysis, but the attack requires only uploader-level credentials and is straightforward to execute against cloud-hosted or internally-networked deployments.
Cross-site request forgery in WWBN AVideo through commit c91b5975d allows unauthenticated remote attackers to hijack authenticated streamers' live broadcasts by tricking them into loading a malicious page. The saveLive.php endpoint in the Live plugin omits both POST-method enforcement (forbidIfNotPost) and CSRF token validation (forbidIfInvalidToken), so a crafted image tag silently overwrites the victim's RTMP key, password, and stream title when loaded by a logged-in streamer. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Cross-site request forgery chained with path traversal in AVideo's stopLive.php enables attackers to trigger recursive deletion of arbitrary server directories when an authenticated administrator visits a malicious page. The vulnerability exists through commit c91b5975d of the WWBN AVideo self-hosted video platform, affecting all versions covered by CPE cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*. The attack exploits missing CSRF token validation in stopLive.php combined with unsanitized concatenation of the key parameter into filesystem paths, allowing payloads like key=../../videos to destroy the videos directory and its contents. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated SQL injection in WWBN AVideo's channels API endpoint allows remote attackers to extract password hashes and account recovery tokens without any credentials. The `sort` column parameter in `get.json.php?APIName=channels` is injected directly into a SQL ORDER BY clause unsanitized, enabling an ordering oracle attack to infer sensitive column values character-by-character and triggering verbose SQL errors that disclose the full query and database schema. No public exploit has been identified at time of analysis, though VulnCheck has independently reported this vulnerability with a GitHub Security Advisory published by the vendor.
Full account takeover in WWBN AVideo arises because the video_id_hash acts as a non-expiring, non-revocable bearer token that authenticates the holder as the video owner with complete administrator privileges. Any attacker who obtains a valid video_id_hash can replay it indefinitely to gain full admin session access, and the credential keeps working even after the victim rotates their password - eliminating the primary recovery mechanism. Reported by VulnCheck with a fix in the vendor GitHub Security Advisory; no public exploit identified at time of analysis, and no EPSS or KEV data was provided.
Cross-site request forgery in WWBN AVideo's referer-validation logic allows unauthenticated remote attackers to trick administrative users into issuing forged requests that modify live server configuration. The flaw resides in the get_domain() and isSameDomain() functions, which fail to reject origins from sibling subdomains or malformed long-gTLD URLs, enabling forged admin-level ObjectYPT writes. No public exploit code or active exploitation has been identified at time of analysis, but the bypass is straightforward to weaponize against any deployment where an attacker can influence an admin to visit a malicious page.
Account takeover in WWBN AVideo is possible because userRecoverPassSave.json.php never checks whether a password-recovery token has expired, so any captured token stays valid forever. An attacker who obtains a recovery token for a target account can reset that account's password at an arbitrary later time and seize full control. Reported by VulnCheck with a coordinated GitHub Security Advisory (GHSA-j9p7-hm85-9v77); no public exploit identified at time of analysis and no EPSS/KEV data supplied.
Login-time security-control bypass in WWBN AVideo (commit e01e41ecc and earlier) lets an attacker who already possesses valid credentials defeat two-factor authentication, brute-force captcha escalation, and login/device audit logging by merely setting the HTTP User-Agent header to the literal string 'AVideoEncoder' or 'AVideoMobileApp'. The isAVideoEncoder()/isAVideoMobileApp() trust decisions rely solely on this client-controlled header with no IP allow-list or shared secret, so the protections are trivially spoofable. No patch is available at the time of analysis and no public exploit has been identified, though the advisory itself fully describes the technique.
Rate-limit bypass in WWBN AVideo (all versions) allows unauthenticated remote attackers to perform unlimited credential-guessing against login endpoints by rotating arbitrary X-Real-IP or X-Forwarded-For header values per request. The enforceRateLimit() function uses the attacker-supplied header as the client identifier without verifying the request originates from a trusted proxy, nullifying IP-based throttling entirely. No public exploit code has been identified at time of analysis, but the technique requires no specialised tooling beyond basic HTTP scripting.
UNION-based SQL injection in AVideo through version 29.0 allows unauthenticated remote attackers to read arbitrary database contents via the User_Location plugin's regions.json.php and cities.json.php endpoints. The country and region GET parameters are passed unsanitized into SQL queries without prepared statement binding, enabling direct extraction of password hashes and sensitive configuration data from the underlying database. No public exploit has been identified at time of analysis, but the UNION-based technique is elementary and well within reach of automated scanning tooling.
Unauthenticated disruption of scheduled live broadcasts in AVideo (all versions, CPE cpe:2.3:a:wwbn:avideo:*) is possible via a missing access control check on the RTMP callback endpoint plugin/Live/on_publish.php. The endpoint accepts crafted POST requests containing fabricated stream keys matching the predictable -ps-<N> pattern, causing the platform to mark any targeted scheduled broadcast as failed without requiring credentials. With a CVSS 4.0 score of 8.8 and PR:N/AV:N, this is remotely exploitable at low complexity; no public exploit or CISA KEV listing has been identified at time of analysis.
Cross-site request forgery in AVideo's plugin/API/set.json.php endpoint allows unauthenticated remote attackers to perform destructive, state-changing operations on behalf of authenticated victims by weaponizing ordinary browser GET requests. The affected endpoint accepts API parameters via GET without enforcing CSRF tokens or origin validation, enabling attackers to delete videos, deactivate user accounts, or manipulate playlists simply by luring an authenticated victim to a crafted URL. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis, though the low technical barrier for GET-based CSRF attacks makes independent replication straightforward.
SSRF filter bypass in WWBN AVideo exposes cloud metadata services and loopback interfaces to authenticated low-privilege attackers. The isSSRFSafeURL function fails to normalize IPv6 NAT64 addresses rendered in hexadecimal notation, allowing crafted URLs such as 64:ff9b::a9fe:a9fe to resolve to protected addresses like 169.254.169.254 while evading the SSRF blocklist. Exploitation could yield cloud instance credentials or access to internal services; no public exploit or KEV listing is confirmed at time of analysis.
Unauthenticated stream credential disclosure in AVideo (WWBN, commit e01e41ecc and earlier) lets remote attackers retrieve any user's restream stream_key and stream_url for external platforms like YouTube, Facebook, and Twitch. The getLiveKey.json.php endpoint accepts a 'token' parameter that bypasses both the Live::canRestream() access gate and the restream ownership check, and the token is merely AES-256-CBC encryptString() of an integer id with no user binding, expiry, or authentication tag. Because a public encryption oracle (view/url2Embed.json.php) lets anyone encrypt arbitrary values, valid tokens can be forged with no authentication; no public exploit is identified at time of analysis but the technique is fully described.
Rate-limiting bypass in WWBN AVideo (through commit e01e41ecc) allows unauthenticated remote attackers to conduct unlimited brute-force attacks against login.json.php and 13 other protected endpoints by exploiting a logic flaw in enforceRateLimit(). The function relies on ObjectYPT::setCacheGlobal to persist per-client attempt counters, but silently discards those writes whenever isBot() classifies the client as a bot - which occurs by default for any request omitting a User-Agent header or using agent strings matching 'curl', 'bot', 'crawler', or 'spider'. No active exploitation has been confirmed at time of analysis, but the trivial bypass mechanism makes this immediately usable for credential stuffing without any specialized tooling.
Privilege escalation in WWBN AVideo through commit 9c39d8c8 enables any user with upload permission to silently hijack an administrator session without knowing their credentials. Two chained functions - deduplicateByEncoderQueueId() exposing video hash tokens without ownership verification, and useVideoHashOrLogin() accepting those tokens as passwordless authentication - create a direct path from low-privilege user to full administrative access. No public exploit has been confirmed and the vulnerability is not listed in CISA KEV, but the low attack complexity and high CIA impact make this a high-priority remediation for any internet-accessible AVideo deployment.
Unauthorized access to restricted video content in WWBN AVideo (through commit 9c39d8c8) is enabled by a fundamental design flaw in the platform's token subsystem: getToken() produces tokens with no binding to user identity or intended purpose, and the Gallery plugin endpoint (plugin/Gallery/view/sections.php) distributes these tokens freely to unauthenticated visitors. Because the tokens carry no scope constraint, they are accepted as valid authorization across unrelated subsystems including the HLS streaming endpoint (view/hls.php), allowing any remote unauthenticated party to retrieve private video content. No public exploit has been identified at time of analysis, but the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) reflects a trivially simple, two-step attack requiring no special tools.
Cross-site request forgery in WWBN AVideo through commit 9c39d8c8 allows remote attackers to permanently publish embargoed videos by tricking an authenticated administrator into loading a malicious GET request targeting the releaseVideoNow.json.php endpoint. The endpoint accepts state-changing GET requests without any CSRF token or origin validation, relying solely on the browser's ambient session cookie. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified, though the GET-based CSRF pattern is trivially weaponizable via a one-pixel image tag or link.
Authorization bypass in WWBN AVideo through commit 9c39d8c8b4c1f75540788d6b391740852ceb0732 allows any authenticated user to forge two-party affiliation consent records and subsequently hijack video ownership of arbitrary content on the platform. The Users_affiliations add.json.php endpoint accepts attacker-controlled counterparty agreement timestamps without verification, enabling creation of forged affiliation records with approved status that are then unconditionally trusted by the videoAddNew.json.php ownership-transfer endpoint. No public exploit code or CISA KEV listing has been identified at time of analysis; however, only a low-privilege account is required, making this accessible to any registered user on a vulnerable instance.
OS command injection in WWBN AVideo through version 29.0 allows attackers to execute arbitrary operating-system commands as the web-server user via the ffmpeg.json.php endpoint. The notifyCode and callback request parameters are concatenated into a shell command without escaping, so an attacker able to produce a valid encrypted payload can inject shell metacharacters and achieve remote code execution. No public exploit identified at time of analysis; the flaw carries a CVSS 4.0 base score of 9.2, though successful exploitation is gated by the requirement to forge a valid encrypted payload.
OS command injection in AVideo (WWBN) through version 29.0 lets remote attackers who can forge a valid encrypted codeToExec payload run arbitrary shell commands as the web-server user via the listFFmpegProcesses() function in the standAlone plugin API. The flaw is unauthenticated (PR:N) but non-trivial to reach because it depends on producing an accepted encrypted parameter, and no public exploit or CISA KEV listing is identified at time of analysis.
Stored DOM cross-site scripting in WWBN AVideo's YPTSocket plugin (all versions prior to 29.0) lets any unauthenticated remote attacker run arbitrary JavaScript in the browser session of any administrator viewing the YPTSocket online-users debug panel. Because the malicious WebSocket metadata is broadcast to every connected client and rendered without escaping, a single anonymous WebSocket connection can be escalated into full administrative account takeover via the admin's own session and CSRF token. No public exploit identified at time of analysis; the flaw carries a CVSS 9.6 (Critical) rating driven by the scope change into the privileged admin origin.
Wallet balance forgery in WWBN AVideo 29.0 and earlier allows any authenticated user to credit their own wallet with arbitrary funds by abusing an unfinished AuthorizeNet payment handler. The plugin/AuthorizeNet/processPayment.json.php endpoint hardcodes payment success and calls YPTWallet::addBalance() using an attacker-supplied amount with no validation of the underlying Authorize.Net transaction. No public exploit has been identified at time of analysis, but the flaw is trivially reproducible from a logged-in account.
Arbitrary file deletion in WWBN AVideo (versions 29.0 and below) lets an authenticated attacker abuse the CloneSite plugin's `deleteDump` GET parameter to `unlink()` any file the web server can access. The `deleteDump` value is concatenated directly onto the clones directory path with no sanitization, so `../../` sequences escape the intended directory. This is an incomplete-fix regression of CVE-2026-33293; publicly available exploit code exists (advisory PoC), but there is no public exploit identified as used in active attacks, and EPSS risk is very low (0.04%).
Cross-origin data exposure in WWBN AVideo 29.0 and earlier lets a malicious website read authenticated /api/* responses because an incomplete CORS fix still reflects arbitrary Origin headers with Access-Control-Allow-Credentials: true. Any logged-in user who visits an attacker-controlled page can have their session-authenticated API responses - containing email, admin status, user ID, and other PII - read cross-origin. Publicly available exploit code exists (SSVC: poc) and the issue is confirmed via GitHub Security Advisory GHSA-ff5q-cc22-fgp4, though EPSS is very low (0.01%) and it is not in CISA KEV.
Cross-origin account takeover in WWBN AVideo (versions 29.0 and below) allows any attacker-controlled website to read authenticated API responses and issue state-changing requests on behalf of a logged-in victim. The `allowOrigin(true)` routine reflects the attacker's `Origin` header into `Access-Control-Allow-Origin` while also sending `Access-Control-Allow-Credentials: true`, and combined with the app's `SameSite=None` session cookie the victim's browser attaches credentials to cross-origin calls to the core get.json.php/set.json.php API. Proof-of-concept exploitation is documented in the GitHub advisory; EPSS is very low (0.04%) and it is not in CISA KEV, so no confirmed active exploitation exists.
Cross-site request forgery in WWBN AVideo (versions 29.0 and prior) lets an attacker abuse a logged-in admin's session against three state-changing JSON endpoints (categoryAddNew, categoryDelete, and pluginRunUpdateScript) that enforce only a role check and omit the CSRF token validation their sibling endpoints use. By luring an authenticated administrator to a malicious page, an attacker can create, overwrite, or delete video categories and trigger execution of any installed plugin's updateScript() method. Publicly available exploit code exists per the SSVC assessment, though EPSS is very low (0.02%, 5th percentile) and it is not on the CISA KEV list.
Remote code execution in AVideo versions 29.0 and below allows unauthenticated attackers to execute arbitrary shell commands on the server via command injection in the CloneSite plugin's cloneServer.json.php endpoint. Attackers exploit unsanitized user input in the 'url' parameter that gets directly concatenated into a wget command executed through PHP's exec() function. With CVSS 8.9 (AV:N/AC:L/PR:N/UI:N) and proof-of-concept exploitation confirmed (E:P), this represents a critical risk requiring immediate patching. Fix available in commit 473c609fc2defdea8b937b00e86ce88eba1f15bb.
Remote code execution in WWBN AVideo up to version 29.0 allows unauthenticated attackers to execute arbitrary system commands via unsanitized URL parameters in test.php. This vulnerability stems from an incomplete fix that sanitized wget calls but left file_get_contents and curl code paths exploitable through regex bypass (accepting strings like 'httpevil[.]com'). CVSS 9.3 with Critical scope change reflects the severity. Upstream fix available in commit 78bccae but no tagged release version confirmed at time of analysis. EPSS data not provided; no CISA KEV listing identified.
Cross-site request forgery in WWBN AVideo (versions ≤ 29.0) lets an attacker fully rewrite global site configuration by luring a logged-in administrator to a malicious page. The `objects/configurationUpdate.json.php` endpoint (aka `/updateConfig`) gates only on `User::isAdmin()` and omits any anti-CSRF token, Origin/Referer check, or `forbidIfIsUntrustedRequest()` call, so a single auto-submitted cross-origin POST can overwrite the encoder URL, SMTP credentials, site `<head>` HTML, logo, favicon, and contact email. Publicly available exploit code exists (SSVC: PoC) but the flaw is not in CISA KEV, and EPSS is very low at 0.02%.
Unauthenticated cross-user JavaScript execution in WWBN AVideo (versions 29.0 and prior) lets a remote attacker broadcast arbitrary code to every connected browser through the YPTSocket WebSocket plugin. Because anonymous visitors are issued valid socket tokens and the server relays the attacker-controlled `msg` and `callback` fields verbatim into client-side eval() sinks, any visitor can execute JavaScript in the origin of all connected users - including administrators - yielding universal account takeover, session theft, and privileged action execution. Publicly available exploit code exists (SSVC: PoC) though the flaw is not listed in CISA KEV, and EPSS is currently low at 0.17%.
Server-Side Request Forgery (SSRF) in WWBN AVideo 26.0 and earlier allows authenticated uploaders to exfiltrate data from internal network resources via objects/aVideoEncoder.json.php. The flaw bypasses existing SSRF protections by permitting attacker-controlled URLs with common media extensions (.mp4, .mp3, .zip, .jpg, .png, .gif, .webm), forcing the server to fetch and store arbitrary remote content. This represents an incomplete fix for CVE-2026-27732. No public exploit identified at time of analysis. CVSS 7.1 with network-accessible attack vector requiring low-privileged authentication.
Path traversal in WWBN AVideo platform ≤26.0 allows authenticated uploaders to read arbitrary server files via GIF poster manipulation. An attacker with uploader privileges can exploit aVideoEncoderReceiveImage.json.php to bypass path sanitization, fetch local files like /etc/passwd or application source code, and republish the contents through publicly accessible GIF media URLs. CVSS 7.6 reflects high confidentiality impact with low-complexity network attack requiring only low-privilege authentication. No public exploit identified at time of analysis, though EPSS data not available for risk quantification.
Unauthenticated remote attackers can bypass CLI-only access controls in WWBN AVideo versions 26.0 and prior via a PHP operator precedence bug in install/deleteSystemdPrivate.php, allowing HTTP access to delete server temp directory files and disclose their contents without authentication. The vulnerability stems from a logic error where !php_sapi_name() === 'cli' evaluates incorrectly due to operator binding precedence, causing the access guard to fail entirely. No public exploit code or active exploitation has been reported at the time of this analysis.
WWBN AVideo 26.0 and prior exposes sensitive user data through 21 unauthenticated API endpoints via the CreatePlugin template generator. The list.json.php template lacks authentication checks present in its companion add.json.php and delete.json.php templates, allowing remote attackers to enumerate and retrieve user PII, payment logs, IP addresses, user agents, and internal system records without authentication. No vendor patch exists at time of analysis.
Unauthenticated attackers can remotely terminate any active live stream in WWBN AVideo 26.0 and prior by sending crafted POST requests to the on_publish_done.php endpoint in the Live plugin. The vulnerability combines two weaknesses: an unauthenticated stats.json.php endpoint that exposes active stream keys, and the on_publish_done.php RTMP callback handler that processes stream termination requests without authentication or authorization checks. This enables complete denial-of-service against all platform live streaming functionality. CVSS 7.5 (High) with network attack vector, low complexity, and no privileges required. No vendor-released patch identified at time of analysis; EPSS data not available.
Cross-site request forgery in WWBN AVideo 26.0 and earlier enables remote attackers to reconfigure critical plugin settings through forged requests targeting admin/save.json.php. The endpoint lacks CSRF token validation while the application sets SameSite=None cookies, allowing attackers to manipulate payment processors, authentication providers, and cloud storage credentials by tricking authenticated administrators into visiting malicious pages. No vendor-released patch identified at time of analysis. EPSS data unavailable; not listed in CISA KEV; no public exploit identified at time of analysis, though exploitation requires only standard CSRF techniques.
Reflected cross-site scripting (XSS) in WWBN AVideo versions up to 26.0 enables credential theft through unsanitized request parameter echoed into JavaScript context. Attackers can craft malicious URLs that, when clicked by authenticated users, execute arbitrary JavaScript and exfiltrate the victim's username and password hash directly exposed in the vulnerable code block. CVSS score of 8.2 reflects high confidentiality impact; no public exploit identified at time of analysis.
SQL injection in WWBN AVideo versions up to 26.0 allows unauthenticated remote attackers to extract sensitive database contents and modify data through the RTMP publish authentication stream key validation mechanism. The vulnerability (CVSS 9.1 Critical) arises from unsanitized string interpolation in Live_schedule::keyExists() fallback logic, affecting the open-source video platform's live streaming infrastructure. No vendor-released patch identified at time of analysis, and no public exploit identified at time of analysis.
WWBN AVideo, an open source video platform, contains a SQL injection vulnerability in the Subscribe::save() method that allows authenticated attackers to execute arbitrary SQL queries. Versions up to and including 26.0 are affected, with the vulnerability stemming from unsanitized user input from the $_POST['user_id'] parameter being concatenated directly into INSERT queries. An attacker with low-level authentication can extract sensitive data including password hashes, API keys, and encryption salts from the database, representing a significant information disclosure risk.
WWBN AVideo video platform up to and including version 26.0 contains an authentication bypass vulnerability in the CDN plugin that allows unauthenticated remote attackers to completely modify CDN configuration settings including storage credentials and authentication keys. The vulnerability stems from the CDN plugin's default empty string authentication key, which causes validation checks to be bypassed entirely when the plugin is enabled but not properly configured. The CVSS score of 8.6 reflects high integrity impact with network-based exploitation requiring no privileges or user interaction.
WWBN AVideo versions up to and including 26.0 contain a critical file upload vulnerability (CWE-434) that allows authenticated attackers to upload and execute arbitrary PHP code on the server. The vulnerability exists in the downloadVideoFromDownloadURL() function which saves remote content with its original filename and extension to a web-accessible directory; by providing an invalid resolution parameter, attackers can bypass cleanup mechanisms, leaving executable PHP files persistent under the web root. With a CVSS score of 8.8, this represents a high-severity remote code execution risk for authenticated users.
WWBN AVideo versions up to and including 26.0 contain an authentication bypass vulnerability in the standalone live stream control endpoint. The endpoint accepts a user-supplied 'streamerURL' parameter that redirects token verification to an attacker-controlled server, allowing complete bypass of authentication without any user interaction. With a CVSS score of 9.4, an attacker gains unauthenticated control over any live stream including the ability to drop publishers, manipulate recordings, and probe stream existence.