AVideo vulnerabilities

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to HTML-encode PGP public keys echoed into a textarea element. An authenticated attacker can inject malicious JavaScript by submitting a crafted public key, which executes in an administrator's session when viewing the user's profile tab.

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the user 'donationLink' profile field. User::setDonationLink() stores the value and save() validates it only with filter_var(..., FILTER_VALIDATE_URL), which accepts strings such as http://evil.example/"onmouseover=alert(document.domain)//, while getDonationLink() applies only strip_tags() and does not encode double quotes. An authenticated user who updates their own profile can break out of the href attribute and inject an event handler that executes JavaScript in the browser of any visitor, including an administrator.

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an unauthenticated file read vulnerability in the getRecordedFile.php endpoint that streams recorded FLV files from the temporary directory. Attackers can request the endpoint with a known or guessed stream key to download recorded live video files without authentication or authorization checks.

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is missing an authentication/authorization check in plugin/WebRTC/status.json.php. When the WebRTC plugin is present, any unauthenticated remote user can request the endpoint and receive JSON containing the absolute filesystem path of the WebRTC2RTMP helper binary, the configured WebRTC port, file_exists/is_executable status, log contents, and port reachability information.

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in playlistRemove.php that allows attackers to delete playlists by skipping CSRF protection checks. Attackers can craft a malicious form that submits a POST request to playlistRemove.php.

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Live/confirmLivePassword.php. The unauthenticated GET parameter u is interpolated directly into an img src attribute without URL- or HTML-encoding, allowing injection of an additional tag with an onerror handler.

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an open redirect in objects/playlistSort.php. Because the endpoint is not a *.json.php script, AVideo's automatic CSRF guard (autoCSRFGuard()/forbidIfIsUntrustedRequest()) does not run, and when the request includes the sort parameter the script issues a Location header set to the unvalidated $_SERVER['HTTP_REFERER'] value without calling isSafeRedirectURL(). A remote unauthenticated attacker can therefore induce a logged-in user who can manage the targeted playlist to submit a cross-origin POST with a crafted Referer, causing the victim's playlist to be reordered and the victim's browser to be redirected from a trusted AVideo URL to an attacker-controlled site for phishing. No patched version is available.

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 does not enforce the Live stream password check on the stats endpoint or on the HLS origin. Live::_getStats() returns a password-protected transmission's RTMP stream key, isPasswordProtected flag, and HLS URL to unauthenticated callers, and the shipped NGINX configuration serves the .m3u8 playlist, AES-128 key, and transport-stream segments without authentication.

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in view/logArchive.json.php. Unauthenticated attackers can archive application logs via GET requests without CSRF token validation, copying sensitive logs to a publicly accessible zip file and truncating the live log.

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in the setPassword.json.php endpoint. Unauthenticated attackers can modify any user's channel password by sending a GET request without CSRF token validation.

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LiveLinks plugin where title and description fields are stored without sanitization. A user with canStream permission can inject malicious scripts that execute in the browser of every visitor viewing the live-link page, including administrators.

WWBN AVideo in versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability. objects/categoryAddNew.json.php passes the POST parameters name and iconClass to Category::setName() and Category::setIconClass(), which store the values without sanitization, and they are later echoed as HTML in views and gallery cards.

In AVideo before 8.1.0, the live-streaming endpoint `view/videosListToLive.php` trusts attacker-supplied data in `webSiteRootURL` as session state, allowing an unauthenticated attacker to self-grant `isLogged` and `canStream`. Video-list paths are interpolated without escaping into `ffprobe` and `ffmpeg` commands executed via `exec`, enabling OS command injection. This is fixed in version 8.1.0.

In AVideo before 8.1.0, the unauthenticated installer endpoint `install/checkConfiguration.php` assembles `videos/configuration.php` by interpolating request parameters, including `webSiteRootURL`, into single-quoted PHP literals without escaping. An attacker can terminate a literal and inject PHP executed as the web-server user. Exploitation requires `videos/configuration.php` to be absent, and database parameters can point to an attacker-controlled server. This is fixed in version 8.1.0.

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting (XSS) vulnerability in the AD_Server plugin's log.php endpoint that fails to escape the label parameter before storage. An unauthenticated attacker can inject malicious HTML through the label parameter, which is later rendered unsanitized in the admin Ad Types report using jQuery .html(), allowing execution of arbitrary JavaScript in an administrator's browser session.

WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account passwords indefinitely. Attackers who obtain a recovery token can use it at any time to change the target account's password and gain full account access.

WWBN AVideo (current e01e41ecc and earlier) makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder()/isAVideoMobileApp() checks match HTTP_USER_AGENT against a hardcoded literal ("AVideoEncoder"/"AVideoMobileApp") with no IP check or shared secret. An attacker who submits valid credentials and sets User-Agent: AVideoEncoder bypasses two-factor authentication, skips brute-force captcha escalation, and avoids being recorded in the login/device audit history. No patch is available at the time of publication.

AVideo has an unauthenticated arbitrary file write vulnerability in the aVideoEncoderChunk.json.php endpoint, allowing remote attackers to write up to 4 GB of arbitrary content via HTTP PUT without authentication.

AVideo before 29.0 contains an incomplete fix for CVE-2026-45578. execAsync() re-wraps escaped commands in double-quoted sh -c, allowing command substitution via $() and backticks. Attackers can inject arbitrary OS commands through the Live plugin on_publish.php endpoint despite escapeshellarg() protection.

WWBN AVideo before version 29.0 contains a stored DOM Cross-Site Scripting vulnerability in the YPTSocket plugin. An unauthenticated remote attacker can execute arbitrary JavaScript in the context of an administrator viewing the online users debug panel.

AVideo versions 14.3.1 prior to 20.1 contain an unauthenticated remote code execution vulnerability caused by predictable generation of an installation salt using PHP uniqid(). The installation timestamp is exposed via a public endpoint, and a derived hash identifier is accessible through unauthenticated API responses, allowing attackers to brute-force the remaining entropy. The recovered salt can then be used to encrypt a malicious payload supplied to a notification API endpoint that evaluates attacker-controlled input, resulting in arbitrary code execution as the web server user.

AVideo versions prior to 20.1 with the ImageGallery plugin enabled is vulnerable to unauthenticated file upload and deletion. Plugin endpoints responsible for managing gallery images fail to enforce authentication checks and do not validate ownership, allowing unauthenticated attackers to upload or delete images associated with any image-based video.

Prior to 8.1.0, AVideo's view/queue.php uses pathinfo on the caller-controlled fileURI and stores its filename through setTitle in encoder_queue.title without neutralization. fileURI is not covered by the objects/security.php filter lists, and the Login::canUpload() capability can be self-granted, allowing an attacker to store an HTML title whose event handler runs in a privileged viewer's browser (an administrator or an operator on the attacker's streamer).

Prior to 8.1.0, AVideo's anonymous login interface reflects request values into HTML and JavaScript without output encoding. webSiteRootURL is returned verbatim by Streamer::getStreamerURL() and reaches navigation and form attributes as well as a JavaScript string in view/index.header.php, while the user and pass fields are filtered only for single quotes, allowing double quotes and angle brackets to break out of HTML attributes. Additionally, view/index.header.php reflects POST fields using json_encode without JSON_HEX_TAG, and locale/function.php stores the POST lang value in the session for unescaped reflection.

An SSRF vulnerability in AVideo (before version 8.1.0) allows an unauthenticated remote attacker to read responses from internal HTTP/HTTPS and FTP services. The `url_get_contents` function does not reject private, loopback, or link-local addresses and disables TLS peer verification, while the `objects/login.json.php` endpoint returns the fetched body. Additionally, `view/youtubeDl.json.php` enables requests to internal FTP servers.

In AVideo before 8.1.0, the encoder lacks a global authentication layer and exposes control and status PHP endpoints to anonymous network callers. The endpoints `view/run.php`, `view/queue.json.php`, `view/status.php`, and `view/listFiles.json.php` allow an unauthenticated attacker to drive the privileged queue processor, read queue and streamer-site information, obtain memory statistics, and enumerate media file names and paths in any directory readable by the web-server user. This is fixed in version 8.1.0.

In AVideo before 8.1.0, the unauthenticated streamer login at `objects/login.json.php` passes the `user` parameter to `Streamer::get`, where it is interpolated into a single-quoted MariaDB SELECT without parameterization or escaping. Although `objects/security.php` strips literal single quotes, `html_entity_decode` in `objects/Login.php` restores entity-encoded quotes before the query. UNION results are exposed through `streamers_id`, while failures return the rendered query and MariaDB error. This is fixed in version 8.1.0.

WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts to delete or modify administrator accounts. Attackers can submit requests to confirmDeleteUser.json.php or userAddNew.json.php targeting administrators to delete their videos and accounts, or change and demote them.

AVideo before 29.1.0 contains a stored cross-site scripting vulnerability in the video trailer1 field rendered unsanitized within an inline onclick JavaScript string. Attackers with video upload permission can store HTML entity-encoded payloads that bypass isValidURL() validation and are decoded by the browser to break out of the JavaScript string, executing arbitrary code in any visitor's session including administrators.

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 uses a cryptographically weak pseudo-random number generator when creating account activation / login pairing codes. getRandomCode() in objects/functions.php derives the code mainly from uniqid(), reducing the code space to roughly 36 x 10^6 values for a known generation second, and an unauthenticated attacker can guess a valid code and gain account access.

AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 uses cryptographically weak uniqid() values for RTMP publish keys in LiveTransmition, reducing key entropy to approximately one million possibilities per creation second. Attackers who know the channel creation time can brute-force the five-digit microsecond component to forge valid stream keys and broadcast content as the channel owner.

AVideo through version 29.0 fails to verify video access permissions in the set_api_comment function, allowing authenticated users to post comments on password-protected and group-restricted videos. Attackers can send POST requests to the comment API endpoint with arbitrary video IDs.

AVideo through version 29.0 fails to validate video access permissions in the API like endpoint, allowing logged-in users to vote on password-protected and group-restricted videos. Attackers can send like and dislike requests to increment vote counters on videos they cannot watch.

AVideo through version 29.0 contains a stored cross-site scripting vulnerability. The unauthenticated view-counter endpoint writes the attacker's User-Agent directly into the database, and it is later rendered without escaping on the video owner's and administrator's statistics page, allowing malicious code execution in their sessions.

AVideo through version 29.0 contains a race condition in the enforceRateLimit() function that fails to atomically increment rate limit counters, allowing attackers to bypass all rate limits including login brute-force protection by issuing concurrent requests. Attackers can exceed the 30-attempts-per-5-minutes login limit by an arbitrary factor.

AVideo (WWBN/AVideo) through version 29.0 is vulnerable to cross-site request forgery (CSRF). The CSRF protection mechanism is disabled when 'user' and 'pass' parameters are present in the request, but their values are not validated. An attacker can exploit this to modify video records, including ownership transfer, removal of access restrictions, and other changes.

In AVideo through version 29.0, Like::__construct() performs counter arithmetic on raw request values before validation, allowing array-typed parameters to desynchronize stored votes from counters. Authenticated attackers can send array-typed like parameters to drive video like counts arbitrarily negative, with the corruption persisting until manual repair.

The CloneSite plugin in AVideo through version 29.0 contains a stored OS command injection vulnerability. The stored SSH password is substituted into the command `sshpass -p '{password}' rsync ...` using plain str_replace without escaping, allowing a single quote to break out and inject arbitrary shell commands. Exploitation requires luring an authenticated administrator into planting a malicious password via a CSRF vector, followed by execution via the documented crontab entry.

In AVideo through version 29.0, the autoCSRFGuard() function maintains a hardcoded allowlist of exempt basenames tested without directory context, allowing plugin files matching core filenames to inherit CSRF exemptions. The LoginWordPress plugin file login.json.php inherits an exemption and unconditionally logs out authenticated users on cross-site POST requests before validating credentials.

WWBN AVideo through 29.0 contains an authentication bypass vulnerability where the stored password hash is accepted as a valid login credential through two independent code paths in loginFromRequest() and encryptPasswordVerify(). Attackers who obtain the stored users.password hash value can authenticate as any user by submitting the hash directly to login endpoints, completely bypassing password verification.

In AVideo through 29.0, the API get_api_video endpoint contains a broken access control vulnerability in the clean_title branch that returns user-group-restricted videos with owner PII to anonymous callers. Attackers can query videos by their public slug to bypass group restrictions and retrieve sensitive user fields including email, phone, address, birth date, and administrator status.

AVideo through 29.0 contains a blind server-side request forgery vulnerability in the getHeaderContentTypeFromURL function that issues get_headers() calls guarded only by format validation. Authenticated users with canUpload permission can store attacker-chosen URLs as video links, triggering vulnerable function execution on every video watch page render to probe internal hosts.

AVideo through 29.0 contains an unauthenticated server-side request forgery vulnerability in the check_site_availability function that accepts attacker-controlled HTTP Host headers. Attackers can send requests to submitIndex.php or ajax.php with arbitrary Host headers to probe internal network hosts and ports, following redirects without authentication.

AVideo through 29.0 contains an insecure direct object reference (IDOR) vulnerability in objects/categoryDeleteAssets.json.php. The endpoint validates only the Category::canCreateCategory() capability and a CSRF nonce before passing the attacker-supplied id to Category::deleteAssets(), which recursively removes the category's asset directory. It omits the Category::userCanEditCategory() ownership check enforced by the sibling Category::delete().

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the Bookmark plugin where chapter names are not encoded before being concatenated into public watch-page HTML. A video owner can inject malicious scripts via the bookmark name parameter, and every visitor of that video executes the payload in the AVideo origin.

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the CustomizeUser plugin where the field_name parameter is stored raw without sanitization. Administrators can inject malicious scripts via the add.json.php endpoint that execute when viewing extra info pages or profile forms that render the typeToHTML function.

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify ownership in addLiveLink.php when updating LiveLinks, allowing authenticated users to modify other users' links. A canStream user can overwrite another user's LiveLink HLS source and metadata by supplying an existing linkId.

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ad impressions in plugin/AD_Server/log.php, allowing logged-in users to submit arbitrary label values that trigger unverified wallet credits to campaign video owners. Attackers can repeatedly POST label=start requests to mint YPTWallet balance for any campaign video without proof an ad actually played.

WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier contains an XML injection vulnerability in plugin/AD_Server/VMAP.php, reachable without authentication when the AD_Server plugin is enabled. The timeOffset and idTag values from the vmaps parameter are written unencoded into VMAP attributes, allowing injection of arbitrary AdBreak and AdTagURI nodes.

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a CSV formula injection vulnerability in the myComments.download.php endpoint that fails to sanitize spreadsheet formula prefixes in comment text. Authenticated users can inject formulas starting with =, +, -, or @ characters.