CVE-2025-34433 AVideo < 20.1 Unauthenticated RCE via Predictable Installation Salt

AVideo versions 14.3.1 prior to 20.1 contain an unauthenticated remote code execution vulnerability caused by predictable generation of an installation salt using PHP uniqid. The installation timestamp is exposed via a public endpoint, and a derived hash identifier is accessible through...

CVE-2025-34433: Improper Control of Generation of Code

AVideo versions 14.3.1 prior to 20.1 contain an unauthenticated remote code execution vulnerability caused by predictable generation of an installation salt using PHP uniqid. The installation timestamp is exposed via a public endpoint, and a derived hash identifier is accessible through...

EUVD-2019-15028

Malware in sbrugna...

EUVD-2016-3638

Malware in sbrugna...

CVE-2019-5440

Use of cryptographically weak PRNG in the password recovery token generation of Revive Adserver v4.2.1 causes a potential authentication bypass attack if an attacker exploits the password recovery functionality. In lib/OA/Dal/PasswordRecovery.php, the function generateRecoveryId generates a...

CVE-2016-2564

Invision Power Services IPS Community Suite before 4.1.9 makes session hijack easier by relying on the PHP uniqid function without the moreentropy flag. Attackers can guess an Invision Power Board session cookie if they can predict the exact time of cookie generation...

Design/Logic Flaw

Invision Power Services IPS Community Suite before 4.1.9 makes session hijack easier by relying on the PHP uniqid function without the moreentropy flag. Attackers can guess an Invision Power Board session cookie if they can predict the exact time of cookie generation...

CVE-2016-2564

Affected product: Invision Power Services (IPS) Community Suite

PT-2017-8055

Name of the Vulnerable Software and Affected Versions Invision Power Services IPS Community Suite versions prior to 4.1.9 Description The issue makes session hijack easier by relying on the PHP uniqid function without the more entropy flag. Attackers can guess an Invision Power Board session cook...

CVE-2016-2564: Insufficient Entropy

Invision Power Services IPS Community Suite before 4.1.9 makes session hijack easier by relying on the PHP uniqid function without the moreentropy flag. Attackers can guess an Invision Power Board session cookie if they can predict the exact time of cookie generation...