CVE-2026-63305

AVideo through 29.0 contains an OS command injection vulnerability in the ffmpeg.json.php endpoint where notifyCode and callback parameters are concatenated into a shell command without escaping. Attackers who can craft a valid encrypted payload can inject arbitrary shell metacharacters into thes...

EUVD-2026-44914

AVideo through 29.0 contains an OS command injection vulnerability in the ffmpeg.json.php endpoint where notifyCode and callback parameters are concatenated into a shell command without escaping. Attackers who can craft a valid encrypted payload can inject arbitrary shell metacharacters into thes...

PT-2026-60463

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 29.0 Description An OS command injection issue exists in the 'ffmpeg.json.php' endpoint. The notifyCode and callback parameters are concatenated into a shell command without proper escaping. An attacker capable of...