{"kind": "version", "path": "vulns/packagist/wwbn%2Favideo/14.3", "name": "wwbn/avideo", "product": "wwbn/avideo", "ecosystem": "Packagist", "version": "14.3", "items": [{"id": "CVE-2026-33731", "noindex": false, "published": "2026-07-16T20:46:53.407Z", "modified": "2026-07-17T11:12:04.938Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "severity": "medium", "epss": 0.00163, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-33731", "title": "AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data", "description": "WWBN AVideo is an open source video platform. In versions prior to 29.0, the Authorize.Net webhook handler at plugin/AuthorizeNet/webhook.php contains a signature verification bypass that allows an attacker to forge webhook requests with arbitrary payment amounts and target user IDs. By supplying a valid transaction ID from a small legitimate purchase, the attacker bypasses signature validation and credits arbitrary wallet balances to any user account via attacker-controlled payload fields. Three flaws combine into an exploit chain: signature bypass via OR logic (webhook.php:33), payload values override API-fetched values (AuthorizeNet.php:16", "references": ["https://github.com/WWBN/AVideo/security/advisories/GHSA-95jh-7r58-xmxw", "https://github.com/WWBN/AVideo/commit/033e83ae904cacb99495dbea7cbcfb3738cf42e4", "https://nvd.nist.gov/vuln/detail/CVE-2026-33731"], "fixes": ["29.0"], "products": [{"name": "wwbn/avideo", "path": "vulns/packagist/wwbn%2Favideo", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-55173", "noindex": false, "published": "2026-07-16T20:41:26.345Z", "modified": "2026-07-17T13:44:36.168Z", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.02678, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-55173", "title": "AVideo incomplete fix for CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command execution at the same execAsync sh -c sink", "description": "WWBN AVideo is an open source video platform. Versions 29.0 and below remain vulnerable to OS command injection because the fix for CVE-2026-33482 was incomplete and still does not neutralize a single & ( the shell background operator). CVE-2026-33482 reported that sanitizeFFmpegCommand() (plugin/API/standAlone/functions.php) failed to strip $(...) command substitution, allowing OS command injection at the execAsync() sh -c sink. The fix (commit 25c8ab90) added $, (, ), {, }, \\n, \\r to the denylist character class and a str_replace('&&', '', ...), but did not account for the single &. ffmpeg.json.php builds the command from _decryptString(get", "references": ["https://github.com/WWBN/AVideo/security/advisories/GHSA-wc3f-xc32-435f", "https://github.com/WWBN/AVideo/commit/c1cfa2bea8a351a1d07f5758f82887403e3abf1f", "https://nvd.nist.gov/vuln/detail/CVE-2026-55173"], "fixes": [], "products": [{"name": "wwbn/avideo", "path": "vulns/packagist/wwbn%2Favideo", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-33692", "noindex": false, "published": "2026-07-16T20:27:04.594Z", "modified": "2026-07-17T13:22:54.547Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "high", "epss": 0.00347, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-33692", "title": "AVideo Has Unauthenticated .env File Exposure via Official Docker Compose Configuration", "description": "WWBN AVideo is an open source video platform. Versions prior to 29.0 expose .env files to unauthenticated users through the official Docker compose configuration. The official docker-compose.yml mounts the entire project root directory as the Apache document root, causing  the .env file — which contains database credentials, admin passwords, and infrastructure configuration — to be served as a static file at /.env. No .htaccess rule or Apache configuration blocks access to dotfiles. Exploitation enables direct database access, admin panel takeover, and further lateral movement within the Docker network. This issue has been resolved in version", "references": ["https://github.com/WWBN/AVideo/security/advisories/GHSA-wf69-r4mx-43rr", "https://github.com/WWBN/AVideo/commit/7f418de1a95ab87bb8c8c3eb3702d71c351e098d", "https://nvd.nist.gov/vuln/detail/CVE-2026-33692"], "fixes": ["29.0"], "products": [{"name": "wwbn/avideo", "path": "vulns/packagist/wwbn%2Favideo", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-54458", "noindex": false, "published": "2026-07-15T21:33:27.190Z", "modified": "2026-07-16T15:12:06.414Z", "cvss": 9.6, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L", "severity": "critical", "epss": 0.00382, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-54458", "title": "AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin", "description": "WWBN AVideo is an open source video platform. Versions prior to 29.0 contain a stored DOM Cross-Site Scripting vulnerability in the YPTSocket plugin. Any unauthenticated remote attacker can execute arbitrary JavaScript in the authenticated origin of every administrator currently viewing a page that renders the YPTSocket online-users debug panel. plugin/YPTSocket/getWebSocket.json.php issues a signed WebSocket token to any anonymous caller, and MessageSQLiteV2::onOpen at plugin/YPTSocket/MessageSQLiteV2.php lines 91 and 110 reads the attacker-controlled webSocketSelfURI and page_title query parameters from the WebSocket connection URL with no ", "references": ["https://github.com/WWBN/AVideo/security/advisories/GHSA-8whc-2wmv-ww35", "https://github.com/WWBN/AVideo/commit/8be71e53ccbe9b84b30870db386fb4d2b11e1c16", "https://nvd.nist.gov/vuln/detail/CVE-2026-54458"], "fixes": ["29.1.0"], "products": [{"name": "wwbn/avideo", "path": "vulns/packagist/wwbn%2Favideo", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-50183", "noindex": false, "published": "2026-07-15T21:13:06.995Z", "modified": "2026-07-16T12:50:47.083Z", "cvss": 4.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00197, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-50183", "title": "WWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery Section", "description": "WWBN AVideo is an open source video platform. Versions 29.0 and below contain a stored Cross-Site Scripting vulnerability in the YouTubeAPI plugin. The plugin renders the snippet.title field returned by the YouTube Data API into the homepage gallery markup with no HTML encoding. The title is set by the YouTube video uploader (anyone in the world) and is treated by AVideo as trusted content. A YouTube uploader who controls a video matching the operator's configured query injects HTML into the AVideo homepage by setting their video's title to a JavaScript-bearing string; the payload then executes in the browser of every visitor who loads any pa", "references": ["https://github.com/WWBN/AVideo/security/advisories/GHSA-66q5-cj5g-wrfx", "https://github.com/WWBN/AVideo/commit/7292129eaee5f609beae103b5cb387d55f17b877", "https://nvd.nist.gov/vuln/detail/CVE-2026-50183"], "fixes": [], "products": [{"name": "wwbn/avideo", "path": "vulns/packagist/wwbn%2Favideo", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-50182", "noindex": false, "published": "2026-07-15T21:04:26.203Z", "modified": "2026-07-17T12:34:49.289Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.0022, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-50182", "title": "AVideo Has Unauthenticated Reflected XSS via $_GET['search'] in YouTubeAPI Gallery Pagination", "description": "WWBN AVideo is an open source video platform. Versions prior to 29.0 contain an unauthenticated Reflected XSS vulnerability through AVideo YouTubeAPI Gallery Pagination. The $_GET['search'] query parameter is concatenated directly into the href attribute of two pagination links in plugin/YouTubeAPI/gallerySection.php (lines 67 and 74) with no htmlspecialchars, no urlencode, and no allow-list check. An injected <script> element is then extracted by the AVideo Layout plugin and concatenated into a single trailing inline script block at the bottom of the page, where the browser executes it.  Any unauthenticated attacker can lure a victim into fo", "references": ["https://github.com/WWBN/AVideo/security/advisories/GHSA-hgjh-6wj8-gcgf", "https://github.com/WWBN/AVideo/commit/f50fc033b7adb36f1ffd6640e7826468bdafdec3", "https://nvd.nist.gov/vuln/detail/CVE-2026-50182"], "fixes": [], "products": [{"name": "wwbn/avideo", "path": "vulns/packagist/wwbn%2Favideo", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-49279", "noindex": false, "published": "2026-07-15T20:57:21.381Z", "modified": "2026-07-18T02:22:09.068Z", "cvss": 7.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00403, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-49279", "title": "WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass)", "description": "WWBN AVideo is an open source video platform. Versions 29.0 and below contain a Stored XSS vulnerability through the autoEvalCodeOnHTML parameter in the MessageSQLite WebSocket Handler. The MessageSQLite.php handler only strips autoEvalCodeOnHTML from $json['msg'], but msgToResourceId() reads from $msg['json'] with higher priority. An attacker can place the XSS payload in the json key instead of msg, bypassing the sanitization entirely. An authenticated attacker can execute arbitrary JavaScript in any connected user's browser session via the WebSocket messaging system, stealing session cookies and authentication tokens, taking over accounts t", "references": ["https://github.com/WWBN/AVideo/security/advisories/GHSA-2fhx-q92v-5fhv", "https://github.com/WWBN/AVideo/commit/3e0b3ce2bfa766183ff0ae227439394db57b1a23", "https://nvd.nist.gov/vuln/detail/CVE-2026-49279"], "fixes": [], "products": [{"name": "wwbn/avideo", "path": "vulns/packagist/wwbn%2Favideo", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-33684", "noindex": false, "published": "2026-07-15T20:47:45.146Z", "modified": "2026-07-16T12:54:14.283Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "medium", "epss": 0.00245, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-33684", "title": "AVideo's Privilege AVideo: Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet Permissions", "description": "WWBN AVideo is an open source video platform. Prior to version 29.0, Privilege Escalation is possible through unguarded permission parameters in signUp API, which allows any user who can solve a CAPTCHA to self-grant elevated permissions during account registration. The set_api_signUp method in the API plugin accepts emailVerified, canUpload, canStream, and canCreateMeet parameters from user-supplied input and applies them to newly created accounts without verifying that the request was authenticated with a valid APISecret. By self-granting account attributes, attackers can mark their own accounts as email-verified without owning the address ", "references": ["https://github.com/WWBN/AVideo/security/advisories/GHSA-8j8m-p79x-g4jm", "https://nvd.nist.gov/vuln/detail/CVE-2026-33684"], "fixes": ["29.0"], "products": [{"name": "wwbn/avideo", "path": "vulns/packagist/wwbn%2Favideo", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-60092", "noindex": false, "published": "2026-07-08T13:51:30.509Z", "modified": "2026-10-08T15:23:31.948Z", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "severity": "medium", "epss": 0.00253, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-60092", "title": "AVideo - Stored Cross-Site Scripting via Unescaped User-Agent in Participants Panel", "description": "AVideo (Meet plugin) through commit e8d6119f3cb1b849149906efeb0a41fc024f59f8 contains a stored cross-site scripting vulnerability in the Meet plugin's getMeetInfo.json.php endpoint. When a participant joins a public meeting, the raw HTTP User-Agent header is stored (meet_join_log.user_agent) without sanitization (bypassing AVideo's setter-level xss_esc() layer) and later echoed without output encoding (no htmlspecialchars()) in the Participants management panel, which is accessible to the meeting host and site administrators. An anonymous, unauthenticated attacker can join any public meeting while supplying a User-Agent header containing an H", "references": ["https://github.com/WWBN/AVideo/security/advisories/GHSA-7cqp-7cfv-6c3q", "https://github.com/WWBN/AVideo/commit/e8d6119f3cb1b849149906efeb0a41fc024f59f8", "https://www.vulncheck.com/advisories/avideo-stored-cross-site-scripting-via-unescaped-user-agent-in-participants-panel"], "fixes": [], "products": [{"name": "wwbn/avideo", "path": "vulns/packagist/wwbn%2Favideo", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-56347", "noindex": false, "published": "2026-06-20T18:27:13.473Z", "modified": "2026-06-22T18:12:45.160Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", "severity": "medium", "epss": 0.002, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-56347", "title": "AVideo TopMenu Plugin - Stored Cross-Site Scripting via Unescaped Menu Item Fields", "description": "AVideo TopMenu plugin through version 26.0 contains a stored cross-site scripting vulnerability in menu item rendering due to missing output encoding of icon classes, URLs, and text labels. Attackers can inject malicious JavaScript through unescaped menu item fields that execute for all site visitors, potentially stealing session cookies or performing unauthorized actions.", "references": ["https://github.com/WWBN/AVideo/security/advisories/GHSA-gmpc-fxg2-vcmq", "https://www.vulncheck.com/advisories/avideo-topmenu-plugin-stored-cross-site-scripting-via-unescaped-menu-item-fields", "https://nvd.nist.gov/vuln/detail/CVE-2026-56347"], "fixes": [], "products": [{"name": "wwbn/avideo", "path": "vulns/packagist/wwbn%2Favideo", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-56346", "noindex": false, "published": "2026-06-20T18:27:12.818Z", "modified": "2026-07-08T19:42:52.437Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00615, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-56346", "title": "AVideo - Unauthenticated PGP Message Decryption via decryptMessage.json.php Endpoint", "description": "AVideo through version 25.0 contains an authentication bypass vulnerability in the decryptMessage.json.php endpoint that allows unauthenticated users to decrypt PGP messages. Remote attackers can submit private keys, ciphertext, and passphrases to perform server-side decryption without credentials, exposing key material to logs and enabling resource exhaustion attacks.", "references": ["https://github.com/WWBN/AVideo/security/advisories/GHSA-5x2w-37xf-7962", "https://www.vulncheck.com/advisories/avideo-unauthenticated-pgp-message-decryption-via-decryptmessage-json-php-endpoint", "https://nvd.nist.gov/vuln/detail/CVE-2026-56346"], "fixes": [], "products": [{"name": "wwbn/avideo", "path": "vulns/packagist/wwbn%2Favideo", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-56345", "noindex": false, "published": "2026-06-20T18:27:12.134Z", "modified": "2026-06-23T02:38:32.930Z", "cvss": 9.2, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "critical", "epss": 0.00453, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-56345", "title": "AVideo - Arbitrary User Session Hijacking via Meet Plugin uploadRecordedVideo Endpoint", "description": "AVideo through 29.0 contains an authorization bypass vulnerability in the Meet plugin's uploadRecordedVideo.json.php endpoint that derives the target users_id from the uploaded filename without verification. An attacker with knowledge of the Meet shared secret can craft a malicious file upload with a filename containing an arbitrary users_id to invoke passwordless User->login() and establish an authenticated session as any user including admin. Attackers can obtain the Meet shared secret through path-traversal vulnerabilities or timing attacks against checkToken.json.php, then POST a crafted file to uploadRecordedVideo.json.php with a filenam", "references": ["https://github.com/WWBN/AVideo/security/advisories/GHSA-qxvm-r42f-5p8j", "https://www.vulncheck.com/advisories/avideo-arbitrary-user-session-hijacking-via-meet-plugin-uploadrecordedvideo-endpoint", "https://nvd.nist.gov/vuln/detail/CVE-2026-56345"], "fixes": [], "products": [{"name": "wwbn/avideo", "path": "vulns/packagist/wwbn%2Favideo", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-56341", "noindex": false, "published": "2026-06-20T18:27:10.827Z", "modified": "2026-06-22T17:24:01.508Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00459, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-56341", "title": "AVideo - Unauthenticated Access to Payment Log DataTables Endpoints via list.json.php", "description": "AVideo through version 26.0 contains multiple unauthenticated list.json.php endpoints in payment plugins lacking authorization checks, exposing PayPal tokens, Authorize.Net webhooks, and Bitcoin transaction records. Unauthenticated attackers can retrieve all payment transaction data including agreement IDs, user financial records, and API responses via direct GET requests to vulnerable endpoints.", "references": ["https://github.com/WWBN/AVideo/security/advisories/GHSA-wprj-9cvc-5w37", "https://www.vulncheck.com/advisories/avideo-unauthenticated-access-to-payment-log-datatables-endpoints-via-list-json-php", "https://nvd.nist.gov/vuln/detail/CVE-2026-56341"], "fixes": [], "products": [{"name": "wwbn/avideo", "path": "vulns/packagist/wwbn%2Favideo", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-45580", "noindex": false, "published": "2026-05-29T13:14:49.977Z", "modified": "2026-06-02T01:09:49.855Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00136, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-45580", "title": "WWBN AVideo Live: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute", "description": "WWBN AVideo is an open source video platform. In 29.0 and earlier, there is a stored cross-site scripting vulnerability. The Live plugin's \"YouTube-style\" view renders the live transmission's stream key into an HTML class attribute by raw echo, without htmlspecialchars(). A canStream user can persist a key containing \" plus an event handler via plugin/Live/saveLive.php, and any visitor (logged in or anonymous) opening the stream's live page executes attacker JavaScript in the platform origin.", "references": ["https://github.com/WWBN/AVideo/security/advisories/GHSA-m5j4-7r85-2cj2", "https://nvd.nist.gov/vuln/detail/CVE-2026-45580"], "fixes": [], "products": [{"name": "wwbn/avideo", "path": "vulns/packagist/wwbn%2Favideo", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-45578", "noindex": false, "published": "2026-05-29T13:14:02.663Z", "modified": "2026-05-29T14:01:56.851Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00318, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-45578", "title": "WWBN AVideo Live: OS command injection in on_publish.php execAsync via unescaped m3u8 URL", "description": "WWBN AVideo is an open source video platform. In 29.0 and earlier, there is a classic shell-metacharacter injection. The YPTSocket notification branch in plugin/Live/on_publish.php builds an execAsync() command line by string concatenation, single-quoting each argument but never calling escapeshellarg(). A ' in any of the three interpolated values ($users_id, $m3u8, $obj->liveTransmitionHistory_id) closes the quoted token and lets the attacker append arbitrary commands.", "references": ["https://github.com/WWBN/AVideo/security/advisories/GHSA-xw67-cg5f-4m2r", "https://nvd.nist.gov/vuln/detail/CVE-2026-45578"], "fixes": [], "products": [{"name": "wwbn/avideo", "path": "vulns/packagist/wwbn%2Favideo", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-45610", "noindex": false, "published": "2026-05-29T13:13:08.942Z", "modified": "2026-05-29T14:00:05.865Z", "cvss": 5.7, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N", "severity": "medium", "epss": 0.0011, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-45610", "title": "WWBN AVideo plugin/LoginControl/set.json.php: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA", "description": "WWBN AVideo is an open source video platform. In 29.0 and earlier, there is a cross-site request forgery vulnerability on the 2FA toggle. plugin/LoginControl/set.json.php accepts POST type=set2FA value=false, calls LoginControl::setUser2FA(User::getId(), false) on the session-authenticated user, and returns. There is no forbidIfIsUntrustedRequest() call, no isTokenValid() check, no X-CSRF-Token/SameSite enforcement, and no re-authentication step. A cross-origin page that the victim visits while logged into the AVideo dashboard issues the POST via a hidden form (or fetch without credentials:\"omit\") and disables the victim's 2FA in one request.", "references": ["https://github.com/WWBN/AVideo/security/advisories/GHSA-3mv2-vmwh-rwfx", "https://nvd.nist.gov/vuln/detail/CVE-2026-45610"], "fixes": [], "products": [{"name": "wwbn/avideo", "path": "vulns/packagist/wwbn%2Favideo", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-45619", "noindex": false, "published": "2026-05-29T13:11:37.401Z", "modified": "2026-05-29T14:02:31.384Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N", "severity": "medium", "epss": 0.00136, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-45619", "title": "AVideo CVE-2026-43884 incomplete fix - `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD post", "description": "WWBN AVideo is an open source video platform. In 29.0 and earlier, EpgParser.php, plugin/AI/receiveAsync.json.php, and other locations do not use the $resolvedIP out-param of isSSRFSafeURL() for DNS pinning via CURLOPT_RESOLVE, opening DNS-rebinding TOCTOU.", "references": ["https://github.com/WWBN/AVideo/security/advisories/GHSA-c3ch-22rq-xfwr", "https://nvd.nist.gov/vuln/detail/CVE-2026-45619"], "fixes": [], "products": [{"name": "wwbn/avideo", "path": "vulns/packagist/wwbn%2Favideo", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-45620", "noindex": false, "published": "2026-05-29T13:07:19.969Z", "modified": "2026-05-30T02:30:36.945Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00193, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-45620", "title": "AVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumeration", "description": "WWBN AVideo is an open source video platform. In 29.0 and earlier, objects/mention.json.php has no User::loginCheck() or admin gate. It only has an entry guard: preg_match('/^@/', $_REQUEST['term']) and hard-coded rowCount=10. This enables unauthenticated user enumeration.", "references": ["https://github.com/WWBN/AVideo/security/advisories/GHSA-vpfx-pxqw-2w79", "https://nvd.nist.gov/vuln/detail/CVE-2026-45620"], "fixes": [], "products": [{"name": "wwbn/avideo", "path": "vulns/packagist/wwbn%2Favideo", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-45731", "noindex": false, "published": "2026-05-29T13:05:02.855Z", "modified": "2026-05-29T14:03:09.980Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00469, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-45731", "title": "WWBN AVideo: Authenticated Arbitrary File Read in view/update.php", "description": "WWBN AVideo is an open source video platform. In 29.0 and earlier, view/update.php reads $_POST['updateFile'] as a relative path under updatedb/ and passes it to PHP's file() for line-by-line execution as part of a database migration. An authenticated administrator can abuse this to read arbitrary text files reachable from the web-server process.", "references": ["https://github.com/WWBN/AVideo/security/advisories/GHSA-3mjv-375j-6h92", "https://nvd.nist.gov/vuln/detail/CVE-2026-45731"], "fixes": [], "products": [{"name": "wwbn/avideo", "path": "vulns/packagist/wwbn%2Favideo", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-46337", "noindex": false, "published": "2026-05-29T13:03:01.529Z", "modified": "2026-05-29T16:21:29.279Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00455, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-46337", "title": "WWBN AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php`", "description": "WWBN AVideo is an open source video platform. In 29.0 and earlier, an unauthenticated remote attacker can read arbitrary image files anywhere on disk that the PHP user can open — including private user-profile photos that the application's normal serving wrappers gate behind ACLs, admin-uploaded thumbnails, encrypted-video poster frames, and image content under sibling-app directories reachable via .. traversal. The endpoint requires no authentication.", "references": ["https://github.com/WWBN/AVideo/security/advisories/GHSA-w4qq-74h6-58wq", "https://nvd.nist.gov/vuln/detail/CVE-2026-46337"], "fixes": [], "products": [{"name": "wwbn/avideo", "path": "vulns/packagist/wwbn%2Favideo", "ecosystem": "Packagist"}]}], "total": 147, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 8, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "wwbn/avideo", "path": "vulns/packagist/wwbn%2Favideo", "ecosystem": "Packagist"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": ["29.0", "26.0", "25.0", "24.0", "22.0", "21.0", "18.0", "14.4", "14.3.1", "14.3", "12.4", "11.6"], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-10-08T15:23:31.948Z", "early_advisories": [], "license": "Puedes utilizar libremente la selección de PatchFirst y nuestras aportaciones (prioridades, alertas tempranas, textos, resúmenes y agregados) para tus propios fines, incluido el uso interno de tu empresa. La reventa, la distribución comercial y la creación masiva de réplicas de esta selección o de estas aportaciones requieren un acuerdo escrito con el operador. Siempre que uses o publiques la selección o nuestras aportaciones, cita a PatchFirst (https://patchfirst.dev/vulns/) con este enlace a la página del flujo de tu región. Los registros originales de fuentes abiertas siguen sujetos a sus respectivas licencias y condiciones. Estas condiciones no limitan tus derechos sobre los datos originales, que puedes obtener directamente de esas fuentes.", "terms_url": "https://patchfirst.dev/es/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst selecciona, normaliza y combina los registros; se pueden añadir resúmenes y traducciones. Las noticias incluyen un enlace a la fuente original en cada entrada.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Las licencias de las bases originales varían; consulta el catálogo de fuentes."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Puntuaciones públicas gratuitas; se solicita atribución (FIRST EPSS, puntuaciones generadas por Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}