CVE-2026-56342: Server-Side Request Forgery (SSRF)

AVideo through version 27.0 contains a server-side request forgery vulnerability in plugin/Live/test.php that allows authenticated administrators to read arbitrary URLs via the statsURL parameter, which lacks isSSRFSafeURL validation and accepts requests to private IP ranges and cloud metadata...

PT-2026-30399

Summary The plugin/Live/test.php endpoint accepts a URL via the statsURL parameter and fetches it server-side using file get contents, curl exec, or wget, returning the full response content in the HTML output. The only validation is a trivial regex /^http/ that does not block requests to...

CVE-2026-33502

WWBN AVideo is an open source video platform. In versions up to and including 26.0, an unauthenticated server-side request forgery vulnerability in "plugin/Live/test.php" allows any remote user to make the AVideo server send HTTP requests to arbitrary URLs. This can be used to probe...

CVE-2026-33502: Server-Side Request Forgery (SSRF)

WWBN AVideo is an open source video platform. In versions up to and including 26.0, an unauthenticated server-side request forgery vulnerability in plugin/Live/test.php allows any remote user to make the AVideo server send HTTP requests to arbitrary URLs. This can be used to probe...