Wwbn

Avideo

164 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
10

CVE-2026-33478

Exploit
  • EPSS 16.24%
  • Veröffentlicht 23.03.2026 14:01:19
  • Zuletzt bearbeitet 24.03.2026 18:51:55

WWBN AVideo is an open source video platform. In versions up to and including 26.0, multiple vulnerabilities in AVideo's CloneSite plugin chain together to allow a completely unauthenticated attacker to achieve remote code execution. The `clones.json...

6.5

CVE-2026-33354

Exploit
  • EPSS 0.04%
  • Veröffentlicht 23.03.2026 13:58:13
  • Zuletzt bearbeitet 24.03.2026 18:57:18

WWBN AVideo is an open source video platform. In versions up to and including 26.0, `POST /objects/aVideoEncoder.json.php` accepts a requester-controlled `chunkFile` parameter intended for staged upload chunks. Instead of restricting that path to tru...

9.8

CVE-2026-33352

Exploit
  • EPSS 0.04%
  • Veröffentlicht 23.03.2026 13:53:47
  • Zuletzt bearbeitet 23.03.2026 15:56:03

WWBN AVideo is an open source video platform. Prior to version 26.0, an unauthenticated SQL injection vulnerability exists in `objects/category.php` in the `getAllCategories()` method. The `doNotShowCats` request parameter is sanitized only by stripp...

9.1

CVE-2026-33351

Exploit
  • EPSS 0.08%
  • Veröffentlicht 23.03.2026 13:51:43
  • Zuletzt bearbeitet 23.03.2026 15:57:06

WWBN AVideo is an open source video platform. Prior to version 26.0, a Server-Side Request Forgery (SSRF) vulnerability exists in `plugin/Live/standAloneFiles/saveDVR.json.php`. When the AVideo Live plugin is deployed in standalone mode (the intended...

9.1

CVE-2026-33297

Exploit
  • EPSS 0.04%
  • Veröffentlicht 23.03.2026 13:46:17
  • Zuletzt bearbeitet 23.03.2026 15:58:42

WWBN AVideo is an open source video platform. Prior to version 26.0, the `setPassword.json.php` endpoint in the CustomizeUser plugin allows administrators to set a channel password for any user. Due to a logic error in how the submitted password valu...

5.4

CVE-2026-33295

Exploit
  • EPSS 0.02%
  • Veröffentlicht 22.03.2026 17:17:09
  • Zuletzt bearbeitet 24.03.2026 17:53:43

WWBN AVideo is an open source video platform. Prior to version 26.0, WWBN/AVideo contains a stored cross-site scripting vulnerability in the CDN plugin's download buttons component. The `clean_title` field of a video record is interpolated directly i...

6.1

CVE-2026-33296

Exploit
  • EPSS 0.03%
  • Veröffentlicht 22.03.2026 17:17:09
  • Zuletzt bearbeitet 24.03.2026 17:52:46

WWBN AVideo is an open source video platform. Prior to version 26.0, WWBN/AVideo contains an open redirect vulnerability in the login flow where a user-supplied redirectUri parameter is reflected directly into a JavaScript `document.location` assignm...

4.3

CVE-2026-33294

Exploit
  • EPSS 0.03%
  • Veröffentlicht 22.03.2026 16:58:09
  • Zuletzt bearbeitet 24.03.2026 21:14:36

WWBN AVideo is an open source video platform. Prior to version 26.0, the BulkEmbed plugin's save endpoint (`plugin/BulkEmbed/save.json.php`) fetches user-supplied thumbnail URLs via `url_get_contents()` without SSRF protection. Unlike all six other U...

8.1

CVE-2026-33293

Exploit
  • EPSS 0.05%
  • Veröffentlicht 22.03.2026 16:35:16
  • Zuletzt bearbeitet 24.03.2026 21:14:05

WWBN AVideo is an open source video platform. Prior to version 26.0, the `deleteDump` parameter in `plugin/CloneSite/cloneServer.json.php` is passed directly to `unlink()` without any path sanitization. An attacker with valid clone credentials can us...

7.5

CVE-2026-33319

Exploit
  • EPSS 0.03%
  • Veröffentlicht 22.03.2026 16:29:08
  • Zuletzt bearbeitet 24.03.2026 19:07:50

WWBN AVideo is an open source video platform. Prior to version 26.0, the `uploadVideoToLinkedIn()` method in the SocialMediaPublisher plugin constructs a shell command by directly interpolating an upload URL received from LinkedIn's API response, wit...