Iniciar sesión
Deutsch English Español Polski
Crítica

AVideo contains Command injection when embedding a video link

  • Publicada: 02.02.2023
  • Actualizado: 11.10.2026 10:22

Impact:

An attacker could execute remote code on a system running wwbn/avideo

Step to Reproduce:

  1. Go to the My Videos tab

https://demo.avideo.com/mvideos

  1. Click "Embed a video link"

Append a command to the url as a query string. eg. ?whoami

then click Save

This issue has been resolved in commit 236228f15

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

PlataformaPaqueteVersiones vulnerablesCorregida en
Paquete de Composer wwbn/avideo < 12.4 12.4

Referencias

Puntuación CVSS 9.6/10
Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Debilidad (CWE)
CWE-79
Plataforma
Composer
Paquete
wwbn/avideo
Publicada
02.02.2023
Actualizado
11.10.2026 10:22

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-pgvh-p3g4-86jw - CC BY 4.0

Historial de vulnerabilidades: wwbn/avideo

Todas las vulnerabilidades publicadas de este paquete (Paquete de Composer), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (160) en el archivo
Entradas en total
160
Primera → última
04.2022 06.2026
Sin corrección
143
Explotada en ataques
0

Distribución por gravedad

  • Crítica 14
  • Alta 61
  • Media 83
  • Baja 2

Divulgaciones por año

Gravedad:
  1. AVideo has an incomplete fix of CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command execution at the same execAsync sh -c sink
    Alta · 8.1 CVE-2026-55173 <= 29.0 sin corrección
  2. AVideo Vulnerable to Unauthenticated .env File Exposure via Official Docker Compose Configuration
    Alta · 7.5 CVE-2026-33692 < 29.0 29.0
  3. WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin
    Crítica · 9.6 CVE-2026-54458 <= 29.0 sin corrección
  4. WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass)
    Alta CVE-2026-49279 <= 29.0 sin corrección
  5. WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint
    Alta · 4.3 CVE-2026-47696 <= 29.0 sin corrección
  6. AVideo: OS command injection in on_publish.php execAsync via unescaped m3u8 URL
    Alta · 8.8 CVE-2026-45578 <= 29.0 sin corrección
  7. AVideo's Meet plugin: `uploadRecordedVideo.json.php` derives `users_id` from the uploaded filename and calls passwordless `User->login()`, allowing any caller with the Meet shared secret to obtain a session as arbitrary users including admin
    Alta · 8.1 CVE-2026-56345 <= 29.0 sin corrección
  8. AVideo Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization
    Alta CVE-2026-43885 <= 29.0 sin corrección
  9. AVideo has SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL()
    Alta · 7.7 CVE-2026-43884 <= 29.0 sin corrección
  10. AVideo has an Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']` Relay Bypass
    Alta · 7.2 CVE-2026-43874 <= 29.0 sin corrección
  11. AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone Server
    Alta · 7.5 CVE-2026-43873 <= 29.0 sin corrección
  12. WWBN AVideo: RCE cause by clonesite plugin
    Alta · 9.8 CVE-2026-41304 <= 29.0 sin corrección
  13. WWBN AVideo has an incomplete fix for CVE-2026-33502: Command Injection
    Alta · 9.3 CVE-2026-41064 <= 29.0 sin corrección
  14. WWBN AVideo has a SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL
    Alta · 7.7 CVE-2026-41060 <= 29.0 sin corrección
  15. WWBN AVideo has a CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) Exposes Authenticated API Responses
    Alta · 7.1 CVE-2026-41057 <= 29.0 sin corrección
  16. WWBN AVideo has CORS Origin Reflection with Credentials on Sensitive API Endpoints Enables Cross-Origin Account Takeover
    Alta · 8.1 CVE-2026-41056 <= 29.0 sin corrección
  17. WWBN AVideo has Multiple CSRF Vulnerabilities in Admin JSON Endpoints (Category CRUD, Plugin Update Script)
    Alta · 7.1 CVE-2026-40926 <= 29.0 sin corrección
  18. WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials
    Alta · 8.3 CVE-2026-40925 <= 29.0 sin corrección
  19. WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks
    Crítica · 10.0 CVE-2026-40911 <= 29.0 sin corrección
  20. WWBN AVideo has a Path Traversal in Locale Save Endpoint Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE)
    Alta · 8.7 CVE-2026-40909 <= 29.0 sin corrección
  21. WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration (Incomplete fix for CVE-2026-27732)
    Alta · 7.1 CVE-2026-39370 <= 26.0 sin corrección
  22. WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLs
    Alta · 7.6 CVE-2026-39369 <= 26.0 sin corrección
  23. AVideo: Unauthenticated Live Stream Termination via RTMP Callback on_publish_done.php
    Alta · 7.5 CVE-2026-34731 <= 26.0 sin corrección
  24. AVideo's CSRF on Admin Plugin Configuration Enables Payment Credential Hijacking
    Alta · 8.1 CVE-2026-34394 <= 26.0 sin corrección
  25. AVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment Page
    Alta · 8.2 CVE-2026-34375 <= 26.0 sin corrección
  26. AVideo: Unauthenticated Access to Payment Log DataTables Endpoints Exposes Transaction Data, PayPal Tokens, and User Financial Records
    Alta · 7.5 CVE-2026-56341 <= 26.0 sin corrección
  27. AVideo has Plaintext Video Password Storage
    Crítica CVE-2026-33867 <= 26.0 sin corrección
  28. AVideo has SQL Injection in category.php fixCleanTitle() via Unparameterized clean_title and id Variables
    Alta CVE-2026-33770 <= 26.0 sin corrección
  29. AVideo has SQL Injection via Partial Prepared Statement — videos_id Concatenated Directly into Query
    Alta CVE-2026-33767 < 26.0 26.0
  30. AVideo is Vulnerable to SQL Injection through Subscribe Endpoint via Unsanitized user_id Parameter
    Alta · 7.1 CVE-2026-33723 <= 26.0 sin corrección
  31. AVideo: Unauthenticated CDN Configuration Takeover via Empty Default Key Bypass and Mass-Assignment
    Alta · 8.6 CVE-2026-33719 <= 26.0 sin corrección
  32. AVideo: Remote Code Execution via PHP Temp File in Encoder downloadURL
    Alta · 8.8 CVE-2026-33717 <= 26.0 sin corrección
  33. AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php
    Crítica · 9.4 CVE-2026-33716 <= 26.0 sin corrección
  34. AVideo has Path Traversal in pluginRunDatabaseScript.json.php Enables Arbitrary SQL File Execution via Unsanitized Plugin Name
    Alta · 7.2 CVE-2026-33681 <= 26.0 sin corrección
  35. AVideo has a Blind SQL Injection in Live Schedule Reminder via Unsanitized live_schedule_id in Scheduler_commands::getAllActiveOrToRepeat()
    Alta · 8.1 CVE-2026-33651 <= 26.0 sin corrección
  36. AVideo: Video Moderator Privilege Escalation via Ownership Transfer Enables Arbitrary Video Deletion
    Alta · 7.6 CVE-2026-33650 <= 26.0 sin corrección
  37. AVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission Modification
    Alta · 8.1 CVE-2026-33649 <= 26.0 sin corrección
  38. AVideo Vulnerable to OS Command Injection via Unsanitized `users_id` and `liveTransmitionHistory_id` in Restreamer Log File Path
    Alta · 8.8 CVE-2026-33648 <= 26.0 sin corrección
  39. AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload
    Alta · 8.8 CVE-2026-33647 <= 26.0 sin corrección
  40. AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP)
    Alta · 8.6 CVE-2026-33513 <= 26.0 sin corrección
  41. AVideo has an unauthenticated decrypt oracle leaking any ciphertext
    Alta · 7.5 CVE-2026-33512 <= 26.0 sin corrección
  42. AVideo Affected by CSRF on Plugin Import Endpoint Enables Unauthenticated Remote Code Execution via Malicious Plugin Upload
    Alta · 8.8 CVE-2026-33507 <= 26.0 sin corrección
  43. AVideo has Unauthenticated SSRF via plugin/Live/test.php
    Crítica · 9.3 CVE-2026-33502 <= 26.0 sin corrección
  44. AVideo has a Path Traversal in import.json.php Allows Private Video Theft and Arbitrary File Read/Deletion via fileURI Parameter
    Alta · 7.1 CVE-2026-33493 <= 26.0 sin corrección
  45. AVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session Regeneration
    Alta · 7.3 CVE-2026-33492 <= 26.0 sin corrección
  46. AVideo has a PGP 2FA Bypass via Cryptographically Broken 512-bit RSA Key Generation in LoginControl Plugin
    Alta · 7.4 CVE-2026-33488 <= 26.0 sin corrección
  47. AVideo has an Unauthenticated Blind SQL Injection in RTMP on_publish Callback via Stream Name Parameter
    Alta · 7.5 CVE-2026-33485 <= 26.0 sin corrección
  48. AVideo Affected by Unauthenticated Disk Space Exhaustion via Unlimited Temp File Creation in aVideoEncoderChunk.json.php
    Alta · 7.5 CVE-2026-33483 <= 26.0 sin corrección
  49. AVideo has an OS Command Injection via $() Shell Substitution Bypass in sanitizeFFmpegCommand()
    Alta · 8.1 CVE-2026-33482 <= 26.0 sin corrección
  50. AVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks Proxy
    Alta · 8.6 CVE-2026-33480 <= 26.0 sin corrección
  51. AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin
    Alta · 8.8 CVE-2026-33479 <= 26.0 sin corrección
  52. AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection
    Crítica · 10.0 CVE-2026-33478 <= 26.0 sin corrección
  53. AVideo has an authenticated arbitrary local file read via `chunkFile` path injection in `aVideoEncoder.json.php`
    Alta · 7.6 CVE-2026-33354 <= 26.0 sin corrección
  54. AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass)
    Crítica · 9.8 CVE-2026-33352 <= 26.0 sin corrección
  55. AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass
    Crítica · 9.1 CVE-2026-33351 <= 26.0 sin corrección
  56. AVideo Affected by Stored XSS via Unescaped Video Title in CDN downloadButtons.php
    Alta CVE-2026-33295 <= 25.0 sin corrección
  57. AVideo Affected by Arbitrary File Deletion via Path Traversal in CloneSite deleteDump Parameter
    Alta · 8.1 CVE-2026-33293 <= 25.0 sin corrección
  58. AVideo has an Authorization Bypass via Path Traversal in HLS Endpoint Allows Streaming Private/Paid Videos
    Alta · 7.5 CVE-2026-33292 <= 25.0 sin corrección
  59. AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy
    Alta · 8.6 CVE-2026-33039 <= 25.0 sin corrección
  60. AVideo affected by Session Hijacking via Unauthenticated Session ID Disclosure with Permissive CORS
    Alta · 8.1 CVE-2026-33043 <= 25.0 sin corrección
  61. AVideo affected by unauthenticated application takeover via exposed web installer on uninitialized deployments
    Alta · 8.1 CVE-2026-33038 <= 25.0 sin corrección
  62. AVideo: Unauthenticated PHP session store exposed to host network via published memcached port
    Alta · 8.1 CVE-2026-29093 <= 21.0 sin corrección
  63. WWBN AVideo is vulnerable to unauthenticated OS Command Injection via base64Url in objects/getImage.php
    Crítica · 9.8 CVE-2026-29058 < 7.0.0 7.0.0
  64. AVideo has Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction
    Crítica CVE-2026-28502 todas las versiones sin corrección
  65. AVideo has Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php
    Crítica · 9.8 CVE-2026-28501 <= 21.0.0 sin corrección
  66. AVideo has Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.php
    Alta · 8.1 CVE-2026-27732 < 22.0 22.0
  67. WWBN AVideo Remote Code Execution
    Crítica · 9.8 CVE-2024-31819 >= 12.4, < 14.3 14.3
  68. WWBN AVideo Insufficient Entropy vulnerbaility
    Crítica · 9.8 CVE-2023-49599 <= 12.4 sin corrección
  69. WWBN AVideo Improper Restriction of Excessive Authentication Attempts vulnerability
    Alta · 7.3 CVE-2023-49810 <= 12.4 sin corrección
  70. WWBN AVideo command injection vulnerability
    Alta · 8.8 CVE-2023-32073 <= 12.4 sin corrección
  71. WWBN/AVideo stored XSS vulnerability leads to takeover of any user's account, including admin's account
    Alta · 8.0 CVE-2023-30860 < 12.4 12.4
  72. Remote code injection in wwbn/avideo
    Alta · 8.8 CVE-2023-30854 < 12.4 12.4
  73. Cross site scripting (XSS) in wwbn/avideo
    Alta ghsa-2fch-hv74-fgw9 < 12.4 12.4
  74. AVideo contains Command injection when embedding a video link esta entrada
    Crítica · 9.6 CVE-2023-25313 < 12.4 12.4
  75. AVideo vulnerable to Improper Privilege Management
    Alta · 8.8 CVE-2020-23489 < 8.9 8.9

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación
Newsletter DockRay

La seguridad de tus aplicaciones en tu correo

Vulnerabilidades importantes, recomendaciones concretas y consejos prácticos para tus aplicaciones. Elige tus tecnologías y sigue lo que importa para tu proyecto.

  • Un resumen diario de nuevas vulnerabilidades, también las críticas.
  • Avisos sobre actualizaciones importantes.
  • Consejos prácticos sobre seguridad y monitorización de aplicaciones.

Déjalo vacío para recibir avisos de todas las tecnologías.

Política de privacidad

Suscripción gratuita. Date de baja con un clic en cualquier correo.