CVE-2021-25875

AVideo/YouPHPTube AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross Script Scripting vulnerabilities via the searchPhrase parameter which allows a remote attacker to steal administrators' session cookies or perform actions as an administrator...

CVE-2021-21286

AVideo Platform is an open-source Audio and Video platform. It is similar to a self-hosted YouTube. In AVideo Platform before version 10.2 there is an authorization bypass vulnerability which enables an ordinary user to get admin control. This is fixed in version 10.2. All queries now remove the...

CVE-2021-25877

AVideo/YouPHPTube 10.0 and prior is affected by Insecure file write. An administrator privileged user is able to write files on filesystem using flag and code variables in file save.php...

AVideo 12.4 Code Injection

============================================================================================================================================= | Title : AVideo 12.4 php code injection Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 130.0.0 64 bits ...

The vulnerability of the submitIndex.php file of the WWBNIndex plugin for the AVideo audio and video file exchange platform allows a hacker to execute arbitrary code.

The vulnerability of the submitIndex.php file of the WWBNIndex plugin for the AVideo audio and video file exchange platform is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially crafted POST request...

Exploit for Code Injection in Wwbn Avideo

Installation et Exécution du script 💻 Prérequis Avant de...

Exploit for Code Injection in Wwbn Avideo

Installation et Exécution du script 💻 Prérequis Avant de...

Metasploit Weekly Wrap-Up 05/23/2024

Infiltrate the Broadcast! A new module from Chocapikk allows the user to perform remote code execution on vulnerable versions of streaming platform AVideo 12.4 - 14.2. The multi/http/avideowwbnindexunauthrce module leverages CVE-2024-31819, a vulnerability to PHP Filter Chaining, to gain...

AVideo WWBNIndex Plugin Unauthenticated Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'AVideo WWBNIndex Plugin Unauthenticated RCE', 'Description' = %q This module exploits an unauthenticated remote code execution RCE vulnerability ...

AVideo cross-site scripting vulnerability in the view/about.php page

The PHP file view/about.php is vulnerable to an XSS issue due to no sanitization of the user agent. At line 53, the website gets the user-agent from the headers through $SERVER'HTTPUSERAGENT' and echo it without any sanitization. In PHP, echo a user generated statement, here the User-Agent Header...

Duplicate Advisory: AVideo cross-site scripting vulnerability in the view/about.php page

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-f98p-2hc5-fm7v. This link is maintained to preserve external references. Original Description WWBN AVideo 12.4 is vulnerable to Cross Site Scripting XSS...

GHSA-QVWG-C35P-RQHJ Duplicate Advisory: AVideo cross-site scripting vulnerability in the view/about.php page

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-f98p-2hc5-fm7v. This link is maintained to preserve external references. Original Description WWBN AVideo 12.4 is vulnerable to Cross Site Scripting XSS...

CVE-2024-34899

WWBN AVideo 12.4 is vulnerable to Cross Site Scripting XSS...

CVE-2024-34899

WWBN AVideo 12.4 is vulnerable to Cross Site Scripting XSS...

CVE-2024-34899

WWBN AVideo 12.4 is vulnerable to Cross Site Scripting XSS...

CVE-2024-34899

CVE-2024-34899 corresponds to a Cross-Site Scripting (XSS) vulnerability in WWBN AVideo 12.4. Connected sources confirm the issue stems from insufficient input sanitization, with explicit mentions of XSS in the view/about.php page (user-agent header echoed without sanitization) and broader XSS de...

CVE-2024-34899

WWBN AVideo 12.4 is vulnerable to Cross Site Scripting XSS...

PT-2024-26240 · Wwbn · Avideo

Name of the Vulnerable Software and Affected Versions: WWBN AVideo version 12.4 Description: The issue is related to Cross Site Scripting XSS due to the lack of sanitization of the HTTP USER AGENT variable. In the view/about.php file, the website retrieves the user agent from the headers through ...

WWBN AVideo Remote Code Execution

An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath parameter of the submitIndex.php component...

GHSA-MV5W-WR5C-575P WWBN AVideo Remote Code Execution

An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath parameter of the submitIndex.php component...