CVE-2023-50172

Summary: CVE-2023-50172 affects WWBN AVideo (dev master, commit 15fed957fb). The vulnerability lies in userRecoverPass.php captcha validation, where the recoverPass value is set even if the captcha check fails, enabling a malicious actor to silently create a recovery pass code for any user. An at...

CVE-2023-50172

A recovery notification bypass vulnerability exists in the userRecoverPass.php captcha validation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to the silent creation of a recovery pass code for any user...

CVE-2023-49810

Summary (validated from provided sources) : CVE-2023-49810 affects WWBN AVideo (dev master commit 15fed957fb). A weakness in checkLoginAttempts can bypass the captcha protection, enabling brute-force login attempts via a sequence of HTTP requests. Talos confirms the vulnerability in the login flo...

CVE-2023-49599

Summary (CVE-2023-49599) : WWBN AVideo dev master commit 15fed957fb is affected by an insufficient entropy vulnerability in the salt generation. The salt is generated via uniqid() and the IV is derived from the install path, while the secret key is the SHA-256 hash of the salt. An attacker can ga...

WWBN AVideo Cross-Site Scripting Vulnerability

WWBN AVideo is a video platform builder written in PHP by the WWBN team. WWBN AVideo suffers from a cross-site scripting vulnerability that originates from a cross-site scripting xss vulnerability in the user name method of the navbarMenuAndLogo.php page...

WWBN AVideo License Issue Vulnerability

WWBN AVideo is a video platform builder written in PHP by the WWBN team. WWBN AVideo suffers from an authorization issue vulnerability that stems from a recovery notification bypass vulnerability in the captcha validation method on the userRecoverPass.php page...

PT-2024-13632 · Wwbn · Wwbn Avideo

Name of the Vulnerable Software and Affected Versions: WWBN AVideo versions 11.6 Description: A cross-site scripting xss vulnerability exists in the function getOpenGraph videoName functionality. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a us...

WWBN AVideo Cross-Site Scripting Vulnerability

WWBN AVideo is a video platform builder written in PHP by the WWBN team. A cross-site scripting vulnerability exists in WWBN AVideo, which stems from a cross-site scripting xss vulnerability in the functiongetOpenGraph videoName method...

WWBN AVideo checkLoginAttempts login attempt restriction bypass vulnerability

Talos Vulnerability Report TALOS-2023-1898 WWBN AVideo checkLoginAttempts login attempt restriction bypass vulnerability January 10, 2024 CVE Number CVE-2023-49810 SUMMARY A login attempt restriction bypass vulnerability exists in the checkLoginAttempts functionality of WWBN AVideo dev master...

WWBN AVideo Security Breach

WWBN AVideo is a video platform builder written in PHP by the WWBN team. A security vulnerability exists in WWBN AVideo, which originates from an information disclosure vulnerability in the image upload method of the aVideoEncoderReceiveImage.json.php page...

WWBN AVideo License Issue Vulnerability

WWBN AVideo is a video platform builder written in PHP by the WWBN team. WWBN AVideo suffers from an authorization issue vulnerability that stems from an under-entropy vulnerability in the recoverPass generation method on the userRecoverPass.php page...

WWBN AVideo navbarMenuAndLogo.php user name cross-site scripting (XSS) vulnerability

Talos Vulnerability Report TALOS-2023-1882 WWBN AVideo navbarMenuAndLogo.php user name cross-site scripting XSS vulnerability January 10, 2024 CVE Number CVE-2023-48730 SUMMARY A cross-site scripting xss vulnerability exists in the navbarMenuAndLogo.php user name functionality of WWBN AVideo dev...

Exploit for Command Injection in Wwbn Avideo

WWBN AVideo currentVersion Authenticated RCE A command in...

GHSA-2MHH-27V7-3VCX WWBN AVideo command injection vulnerability

WWBN AVideo Authenticated RCE A command injection vulnerability exists at plugin/CloneSite/cloneClient.json.php which allows Remote Code Execution if you CloneSite Plugin. This is a bypass to the fix for CVE-2023-30854 which affects WWBN Avideo up to version 12.3 Vulnerable Code...

WWBN AVideo command injection vulnerability

WWBN AVideo Authenticated RCE A command injection vulnerability exists at plugin/CloneSite/cloneClient.json.php which allows Remote Code Execution if you CloneSite Plugin. This is a bypass to the fix for CVE-2023-30854 which affects WWBN Avideo up to version 12.3 Vulnerable Code...

Command injection

WWBN AVideo is an open source video platform. In versions 12.4 and prior, a command injection vulnerability exists at plugin/CloneSite/cloneClient.json.php which allows Remote Code Execution if you CloneSite Plugin. This is a bypass to the fix for CVE-2023-30854, which affects WWBN AVideo up to...

PT-2023-23584 · Wwbn · Wwbn Avideo

Name of the Vulnerable Software and Affected Versions: WWBN AVideo versions prior to 12.4 Description: A command injection issue exists in WWBN AVideo, allowing Remote Code Execution when the CloneSite Plugin is used. This issue is related to the plugin/CloneSite/cloneClient.json.php endpoint. It...

WWBN AVideo 命令注入漏洞

WWBN AVideo is a video platform builder written in PHP by the WWBN team. A command injection vulnerability exists in WWBN AVideo versions prior to 12.4, which stems from the presence of a command injection vulnerability that can be exploited by an attacker to remotely execute code...

Cross-Site Scripting (XSS)

wwbn/avideo, is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to a lack of user-input sanitization in script.js which allows an attacker to inject and execute arbitrary JavaScript into the browser...

Remote Code Execution (RCE)

wwbn/avideo is vulnerable to Remote Code Execution RCE. The vulnerability exists due to a lack of validation in cloneClient.json.php which allows an admin authenticated attacker to inject and execute arbitrary commands...