World Wide Broadcast Network AVideo-Encoder code injection vulnerability

Versions prior to AVideo-Encoder 8.1.0 of the World Wide Broadcast Network contain a code injection vulnerability. This vulnerability arises because the unauthenticated installer endpoint install/checkConfiguration.php fails to escape request parameters when inserting them into single-quoted PHP...

World Wide Broadcast Network AVideo-Encoder SQL injection vulnerability

Versions prior to AVideo-Encoder 8.1.0 of the World Wide Broadcast Network contain an SQL injection vulnerability. This vulnerability arises because unauthenticated streamers log user parameters without proper parameterization or escaping into MariaDB queries. As a result, attackers may exploit...

World Wide Broadcast Network AVideo-Encoder authorization issue vulnerability

Versions prior to AVideo-Encoder 8.1.0 of the World Wide Broadcast Network contain an authorization issue vulnerability. This vulnerability stems from the encoder lacking a global authentication layer; the view/run.php file is protected via comments and calls Encoder::run. view/queue.json.php...

World Wide Broadcast Network AVideo-Encoder server request forgery vulnerability

Versions prior to AVideo-Encoder 8.1.0 of the World Wide Broadcast Network contain a server-side request forgery vulnerability. This vulnerability arises because urlgetcontents in objects/functions.php performs only syntactic validation on URLs controlled by callers; it fails to reject private,...

World Wide Broadcast Network AVideo-Encoder Cross-site Scripting Vulnerability

Versions prior to AVideo-Encoder 8.1.0 of the World Wide Broadcast Network contain a cross-site scripting vulnerability. This vulnerability arises because view/queue.php utilizes pathinfo when handling fileURI values controlled by callers. Additionally, setTitle is used to store filenames without...

World Wide Broadcast Network AVideo-Encoder Cross-site Scripting Vulnerability

Versions prior to AVideo-Encoder 8.1.0 of the World Wide Broadcast Network contain a cross-site scripting vulnerability. This vulnerability arises because the anonymous login interface fails to properly encode request values such as webSiteRootURL, user, pass, and POST lang within view/index.php,...

World Wide Broadcast Network AVideo-Encoder command injection vulnerability

Versions prior to AVideo-Encoder 8.1.0 of the World Wide Broadcast Network contain a command injection vulnerability. This vulnerability arises because the live streaming endpoint view/videosListToLive.php trusts the webSiteRootURL and the JSON session state returned during login. The video list...

World Wide Broadcast Network AVideo path traversal vulnerability

Versions prior to AVideo 29.5.0 of the World Wide Broadcast Network contain a path traversal vulnerability stemming from local file inclusion issues. Unauthenticated attackers can exploit this by including PHP files outside the locale directory via a specially crafted Accept-Language header, then...

World Wide Broadcast Network AVideo Cross-site Scripting Vulnerability

In versions AVideo 26.0 through 29.3.0 of the World Wide Broadcast Network, there is a cross-site scripting vulnerability. This vulnerability arises because MarkdownToHTML retains event handling attributes within HTML blocks, allowing authenticated commenters to inject JavaScript. Attackers can...

World Wide Broadcast Network AVideo server request forgery vulnerability

Versions prior to AVideo 29.4.0 of the World Wide Broadcast Network contain a server-side request forgery vulnerability. This vulnerability arises because getheaders in getHeaderContentTypeFromURL fails to revalidate the target URL via isSSRFSafeURL after a redirect, resulting in blind server-sid...

World Wide Broadcast Network AVideo authorization issue vulnerability

Versions of World Wide Broadcast Network AVideo prior to 29.4.0 contain an authorization issue vulnerability. This vulnerability stems from improper authorization checks, allowing a delegated Users Admin account to submit requests to confirmDeleteUser.json.php or userAddNew.json.php. Such request...

World Wide Broadcast Network AVideo cross-site request forgery vulnerability

Versions prior to AVideo 24.0 of the World Wide Broadcast Network contain a cross-site request forgery vulnerability. This flaw stems from older endpoints such as playlistStatus.php, which bypasses the autoCSRFGuard check specifically applied to .json.php. As a result, attackers can exploit this...

Astra Linux – Vulnerability in NTP

In ntp 4.2.8p10, 4.2.8p11, 4.2.8p12, and 4.2.8p13, remote attackers can prevent a broadcast client from synchronizing its clock with a broadcast NTP server through soofed modes 3 and 5. The attacker must either be part of the same broadcast network or control a slave device in that broadcast...

CVE-2025-32899

In KDE Connect before 1.33.0 on Android, a packet can be crafted that causes two paired devices to unpair. Specifically, it is an invalid discovery packet sent over broadcast UDP...

EUVD-2025-201335

In KDE Connect before 1.33.0 on Android, malicious device IDs sent via broadcast UDP could cause an application crash...

CVE-2025-32899

In KDE Connect before 1.33.0 on Android, a packet can be crafted that causes two paired devices to unpair. Specifically, it is an invalid discovery packet sent over broadcast UDP...

EUVD-2018-20563

Malware in sbrugna...

CVE-2023-25313

OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbitrary code via the video link field to the Embed a video link feature...

CVE-2023-25314

Cross Site Scripting XSS vulnerability in World Wide Broadcast Network AVideo before 12.4, allows attackers to gain sensitive information via the success parameter to /user...

Design/Logic Flaw

OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbitrary code via the video link field to the Embed a video link feature...