CVE-2026-64625 AVideo before 29.0 OS Command Injection via execAsync

AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync re-wraps escaped commands in double-quoted sh -c, allowing command substitution via $ and backticks. Attackers can inject arbitrary OS commands through the Live plugin onpublish.php endpoint despite escapeshellarg...

CVE-2026-64626 AVideo Encoder downloadURL SSRF via unpinned retry fallback

AVideo versions from commit 0dbadbca through latest master contain a server-side request forgery vulnerability in the encoder download-by-URL flow due to an unpinned retry fallback that bypasses DNS pinning validation. An authenticated attacker can supply a downloadURL that redirects to an intern...

CVE-2026-64626 AVideo Encoder downloadURL SSRF via unpinned retry fallback

AVideo versions from commit 0dbadbca through latest master contain a server-side request forgery vulnerability in the encoder download-by-URL flow due to an unpinned retry fallback that bypasses DNS pinning validation. An authenticated attacker can supply a downloadURL that redirects to an intern...

CVE-2026-64626: Server-Side Request Forgery (SSRF)

AVideo versions from commit 0dbadbca through latest master contain a server-side request forgery vulnerability in the encoder download-by-URL flow due to an unpinned retry fallback that bypasses DNS pinning validation. An authenticated attacker can supply a downloadURL that redirects to an intern...

CVE-2026-64625: Improper Neutralization of Special Elements used in an OS Command

AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync re-wraps escaped commands in double-quoted sh -c, allowing command substitution via $ and backticks. Attackers can inject arbitrary OS commands through the Live plugin onpublish.php endpoint despite escapeshellarg...

CVE-2026-55173

WWBN AVideo is an open source video platform. Versions 29.0 and below remain vulnerable to OS command injection because the fix for CVE-2026-33482 was incomplete and still does not neutralize a single & the shell background operator. CVE-2026-33482 reported that sanitizeFFmpegCommand...

CVE-2026-33731

WWBN AVideo is an open source video platform. In versions prior to 29.0, the Authorize.Net webhook handler at plugin/AuthorizeNet/webhook.php contains a signature verification bypass that allows an attacker to forge webhook requests with arbitrary payment amounts and target user IDs. By supplying...

CVE-2026-33731

CVE-2026-33731 (AVideo) affects versions prior to 29.0. The webhook flaw in plugin/AuthorizeNet/webhook.php enables a signature verification bypass, allowing an attacker to forge webhook data and credit arbitrary wallet balances by using a legitimate transaction ID. The exploit chain combines: (1...

CVE-2026-33731 AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data

WWBN AVideo is an open source video platform. In versions prior to 29.0, the Authorize.Net webhook handler at plugin/AuthorizeNet/webhook.php contains a signature verification bypass that allows an attacker to forge webhook requests with arbitrary payment amounts and target user IDs. By supplying...

CVE-2026-55173

Summary: CVE-2026-55173 affects WWBN AVideo (versions 29.0 and below). The issue is an OS command injection in the ffmpeg command construction: sanitizeFFmpegCommand() fails to neutralize a single ‘&’ (background operator). The fix from CVE-2026-33482 added several metacharacters to the denylist ...

CVE-2026-33692 AVideo Has Unauthenticated .env File Exposure via Official Docker Compose Configuration

WWBN AVideo is an open source video platform. Versions prior to 29.0 expose .env files to unauthenticated users through the official Docker compose configuration. The official docker-compose.yml mounts the entire project root directory as the Apache document root, causing the .env file — which...

CVE-2026-33692 AVideo Has Unauthenticated .env File Exposure via Official Docker Compose Configuration

WWBN AVideo is an open source video platform. Versions prior to 29.0 expose .env files to unauthenticated users through the official Docker compose configuration. The official docker-compose.yml mounts the entire project root directory as the Apache document root, causing the .env file — which...

CVE-2026-33692 AVideo Has Unauthenticated .env File Exposure via Official Docker Compose Configuration

WWBN AVideo is an open source video platform. Versions prior to 29.0 expose .env files to unauthenticated users through the official Docker compose configuration. The official docker-compose.yml mounts the entire project root directory as the Apache document root, causing the .env file — which...

CVE-2026-63305

AVideo through 29.0 contains an OS command injection vulnerability in the ffmpeg.json.php endpoint where notifyCode and callback parameters are concatenated into a shell command without escaping. Attackers who can craft a valid encrypted payload can inject arbitrary shell metacharacters into thes...

CVE-2026-63304

AVideo through 29.0 contains an OS command injection vulnerability in plugin/API/standAlone/functions.php where the listFFmpegProcesses function interpolates unsanitized keyword parameters inside single quotes without escaping. Attackers who can craft a valid encrypted codeToExec payload can brea...

CVE-2026-63304

AVideo through 29.0 contains an OS command injection vulnerability in plugin/API/standAlone/functions.php where the listFFmpegProcesses function interpolates unsanitized keyword parameters inside single quotes without escaping. Attackers who can craft a valid encrypted codeToExec payload can brea...

CVE-2026-63304 AVideo through 29.0 OS Command Injection via listFFmpegProcesses

AVideo through 29.0 contains an OS command injection vulnerability in plugin/API/standAlone/functions.php where the listFFmpegProcesses function interpolates unsanitized keyword parameters inside single quotes without escaping. Attackers who can craft a valid encrypted codeToExec payload can brea...

CVE-2026-63305

The CVE-2026-63305 entry concerns AVideo up to version 29.0, where the ffmpeg.json.php endpoint concatenates notifyCode and callback into a shell command without escaping. This allows an attacker who can craft an encrypted payload to inject shell metacharacters and execute OS commands as the web-...

EUVD-2026-44913

AVideo through 29.0 contains an OS command injection vulnerability in plugin/API/standAlone/functions.php where the listFFmpegProcesses function interpolates unsanitized keyword parameters inside single quotes without escaping. Attackers who can craft a valid encrypted codeToExec payload can brea...

CVE-2026-63305 AVideo through 29.0 OS Command Injection via ffmpeg.json.php

AVideo through 29.0 contains an OS command injection vulnerability in the ffmpeg.json.php endpoint where notifyCode and callback parameters are concatenated into a shell command without escaping. Attackers who can craft a valid encrypted payload can inject arbitrary shell metacharacters into thes...