Arbitrary Code Injection

Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to Arbitrary Code Injection through the autoEvalCodeOnHTML process. An attacker can execute arbitrary JavaScript code in the browser context of any logged-in user by...

AVideo <= 26.0 - WWBN AVideo - Remote Code Execution

WWBN AVideo = 26.0 contains multiple vulnerabilities in the CloneSite plugin including unauthenticated exposure of clone secret keys and OS command injection in rsync command construction, letting unauthenticated attackers achieve remote code execution. id: CVE-2026-33478 info: name: AVideo = 26....

VulnCheck KEV: CVE-2026-33478

WWBN AVideo is an open source video platform. In versions up to and including 26.0, multiple vulnerabilities in AVideo's CloneSite plugin chain together to allow a completely unauthenticated attacker to achieve remote code execution. The clones.json.php endpoint exposes clone secret keys without...

CVE-2026-43885

creationtimestamp| type| source ---|---|--- 2026-04-27 17:25:06+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-xr49-f4rh-qcjf...

CVE-2026-43884

creationtimestamp| type| source ---|---|--- 2026-04-27 17:14:12+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-2hch-c97c-g99x...

CVE-2026-43883

creationtimestamp| type| source ---|---|--- 2026-04-27 17:05:12+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-958h-qp3x-q4gj...

CVE-2026-43882

creationtimestamp| type| source ---|---|--- 2026-04-27 15:39:50+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-mwgh-92m2-wvhv...

CVE-2026-43879

creationtimestamp| type| source ---|---|--- 2026-04-27 14:39:23+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-wp38-whx3-xffh...

CVE-2026-43878

creationtimestamp| type| source ---|---|--- 2026-04-25 01:13:27+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-mm5f-8q57-4fc4...

CVE-2026-43876

creationtimestamp| type| source ---|---|--- 2026-04-25 00:57:12+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-g9cm-rxp7-6gv5...

CVE-2026-43875

creationtimestamp| type| source ---|---|--- 2026-04-25 00:54:22+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-5w8w-26ch-v5cw...

Guessable CAPTCHA

Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to Guessable CAPTCHA through the objects/getCaptcha.php process. An attacker can bypass CAPTCHA protections by manipulating the ql parameter to generate trivially sho...

Cross-site Request Forgery (CSRF)

Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the commentDelete.json.php process. An attacker can cause unauthorized deletion of comments by tricking an authenticated user...

Active Debug Code

Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to Active Debug Code via the git.json.php file. An attacker can obtain sensitive information, including developer email addresses, deployed commit hashes, and commit...

CVE-2026-41304

WWBN AVideo is an open source video platform. In versions 29.0 and below, the cloneServer.json.php endpoint in the CloneSite plugin constructs shell commands using user-controlled input url parameter without proper sanitization. The input is directly concatenated into a wget command executed via...

CVE-2026-41064

WWBN AVideo is an open source video platform. In versions up to and including 29.0, an incomplete fix for AVideo's test.php adds escapeshellarg for wget but leaves the filegetcontents and curl code paths unsanitized, and the URL validation regex /^http/ accepts strings like httpevil.com. Commit...

CVE-2026-41304: Improper Neutralization of Special Elements used in a Command

WWBN AVideo is an open source video platform. In versions 29.0 and below, the cloneServer.json.php endpoint in the CloneSite plugin constructs shell commands using user-controlled input url parameter without proper sanitization. The input is directly concatenated into a wget command executed via...

CVE-2026-41064: Improper Neutralization of Special Elements used in an OS Command

WWBN AVideo is an open source video platform. In versions up to and including 29.0, an incomplete fix for AVideo's test.php adds escapeshellarg for wget but leaves the filegetcontents and curl code paths unsanitized, and the URL validation regex /^http/ accepts strings like httpevil.com. Commit...

CVE-2026-41058

WWBN AVideo is an open source video platform. In versions 29.0 and below, the incomplete fix for AVideo's CloneSite deleteDump parameter does not apply path traversal filtering, allowing unlink of arbitrary files via ../../ sequences in the GET parameter. Commit...

CVE-2026-41060

WWBN AVideo is an open source video platform. In versions 29.0 and below, the isSSRFSafeURL function in objects/functions.php contains a same-domain shortcircuit lines 4290-4296 that allows any URL whose hostname matches webSiteRootURL to bypass all SSRF protections. Because the check compares on...