{"kind": "version", "path": "vulns/packagist/wwbn%2Favideo/29.0", "name": "wwbn/avideo", "product": "wwbn/avideo", "ecosystem": "Packagist", "version": "29.0", "items": [{"id": "CVE-2026-55173", "noindex": false, "published": "2026-07-16T20:41:26.345Z", "modified": "2026-07-17T13:44:36.168Z", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.02678, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-55173", "title": "AVideo incomplete fix for CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command execution at the same execAsync sh -c sink", "description": "WWBN AVideo is an open source video platform. Versions 29.0 and below remain vulnerable to OS command injection because the fix for CVE-2026-33482 was incomplete and still does not neutralize a single & ( the shell background operator). CVE-2026-33482 reported that sanitizeFFmpegCommand() (plugin/API/standAlone/functions.php) failed to strip $(...) command substitution, allowing OS command injection at the execAsync() sh -c sink. The fix (commit 25c8ab90) added $, (, ), {, }, \\n, \\r to the denylist character class and a str_replace('&&', '', ...), but did not account for the single &. ffmpeg.json.php builds the command from _decryptString(get", "references": ["https://github.com/WWBN/AVideo/security/advisories/GHSA-wc3f-xc32-435f", "https://github.com/WWBN/AVideo/commit/c1cfa2bea8a351a1d07f5758f82887403e3abf1f", "https://nvd.nist.gov/vuln/detail/CVE-2026-55173"], "fixes": [], "products": [{"name": "wwbn/avideo", "path": "vulns/packagist/wwbn%2Favideo", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-54458", "noindex": false, "published": "2026-07-15T21:33:27.190Z", "modified": "2026-07-16T15:12:06.414Z", "cvss": 9.6, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L", "severity": "critical", "epss": 0.00382, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-54458", "title": "AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin", "description": "WWBN AVideo is an open source video platform. Versions prior to 29.0 contain a stored DOM Cross-Site Scripting vulnerability in the YPTSocket plugin. Any unauthenticated remote attacker can execute arbitrary JavaScript in the authenticated origin of every administrator currently viewing a page that renders the YPTSocket online-users debug panel. plugin/YPTSocket/getWebSocket.json.php issues a signed WebSocket token to any anonymous caller, and MessageSQLiteV2::onOpen at plugin/YPTSocket/MessageSQLiteV2.php lines 91 and 110 reads the attacker-controlled webSocketSelfURI and page_title query parameters from the WebSocket connection URL with no ", "references": ["https://github.com/WWBN/AVideo/security/advisories/GHSA-8whc-2wmv-ww35", "https://github.com/WWBN/AVideo/commit/8be71e53ccbe9b84b30870db386fb4d2b11e1c16", "https://nvd.nist.gov/vuln/detail/CVE-2026-54458"], "fixes": ["29.1.0"], "products": [{"name": "wwbn/avideo", "path": "vulns/packagist/wwbn%2Favideo", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-50183", "noindex": false, "published": "2026-07-15T21:13:06.995Z", "modified": "2026-07-16T12:50:47.083Z", "cvss": 4.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00197, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-50183", "title": "WWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery Section", "description": "WWBN AVideo is an open source video platform. Versions 29.0 and below contain a stored Cross-Site Scripting vulnerability in the YouTubeAPI plugin. The plugin renders the snippet.title field returned by the YouTube Data API into the homepage gallery markup with no HTML encoding. The title is set by the YouTube video uploader (anyone in the world) and is treated by AVideo as trusted content. A YouTube uploader who controls a video matching the operator's configured query injects HTML into the AVideo homepage by setting their video's title to a JavaScript-bearing string; the payload then executes in the browser of every visitor who loads any pa", "references": ["https://github.com/WWBN/AVideo/security/advisories/GHSA-66q5-cj5g-wrfx", "https://github.com/WWBN/AVideo/commit/7292129eaee5f609beae103b5cb387d55f17b877", "https://nvd.nist.gov/vuln/detail/CVE-2026-50183"], "fixes": [], "products": [{"name": "wwbn/avideo", "path": "vulns/packagist/wwbn%2Favideo", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-50182", "noindex": false, "published": "2026-07-15T21:04:26.203Z", "modified": "2026-07-17T12:34:49.289Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.0022, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-50182", "title": "AVideo Has Unauthenticated Reflected XSS via $_GET['search'] in YouTubeAPI Gallery Pagination", "description": "WWBN AVideo is an open source video platform. Versions prior to 29.0 contain an unauthenticated Reflected XSS vulnerability through AVideo YouTubeAPI Gallery Pagination. The $_GET['search'] query parameter is concatenated directly into the href attribute of two pagination links in plugin/YouTubeAPI/gallerySection.php (lines 67 and 74) with no htmlspecialchars, no urlencode, and no allow-list check. An injected <script> element is then extracted by the AVideo Layout plugin and concatenated into a single trailing inline script block at the bottom of the page, where the browser executes it.  Any unauthenticated attacker can lure a victim into fo", "references": ["https://github.com/WWBN/AVideo/security/advisories/GHSA-hgjh-6wj8-gcgf", "https://github.com/WWBN/AVideo/commit/f50fc033b7adb36f1ffd6640e7826468bdafdec3", "https://nvd.nist.gov/vuln/detail/CVE-2026-50182"], "fixes": [], "products": [{"name": "wwbn/avideo", "path": "vulns/packagist/wwbn%2Favideo", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-49279", "noindex": false, "published": "2026-07-15T20:57:21.381Z", "modified": "2026-07-18T02:22:09.068Z", "cvss": 7.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00403, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-49279", "title": "WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass)", "description": "WWBN AVideo is an open source video platform. Versions 29.0 and below contain a Stored XSS vulnerability through the autoEvalCodeOnHTML parameter in the MessageSQLite WebSocket Handler. The MessageSQLite.php handler only strips autoEvalCodeOnHTML from $json['msg'], but msgToResourceId() reads from $msg['json'] with higher priority. An attacker can place the XSS payload in the json key instead of msg, bypassing the sanitization entirely. An authenticated attacker can execute arbitrary JavaScript in any connected user's browser session via the WebSocket messaging system, stealing session cookies and authentication tokens, taking over accounts t", "references": ["https://github.com/WWBN/AVideo/security/advisories/GHSA-2fhx-q92v-5fhv", "https://github.com/WWBN/AVideo/commit/3e0b3ce2bfa766183ff0ae227439394db57b1a23", "https://nvd.nist.gov/vuln/detail/CVE-2026-49279"], "fixes": [], "products": [{"name": "wwbn/avideo", "path": "vulns/packagist/wwbn%2Favideo", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-60092", "noindex": false, "published": "2026-07-08T13:51:30.509Z", "modified": "2026-10-08T15:23:31.948Z", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "severity": "medium", "epss": 0.00253, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-60092", "title": "AVideo - Stored Cross-Site Scripting via Unescaped User-Agent in Participants Panel", "description": "AVideo (Meet plugin) through commit e8d6119f3cb1b849149906efeb0a41fc024f59f8 contains a stored cross-site scripting vulnerability in the Meet plugin's getMeetInfo.json.php endpoint. When a participant joins a public meeting, the raw HTTP User-Agent header is stored (meet_join_log.user_agent) without sanitization (bypassing AVideo's setter-level xss_esc() layer) and later echoed without output encoding (no htmlspecialchars()) in the Participants management panel, which is accessible to the meeting host and site administrators. An anonymous, unauthenticated attacker can join any public meeting while supplying a User-Agent header containing an H", "references": ["https://github.com/WWBN/AVideo/security/advisories/GHSA-7cqp-7cfv-6c3q", "https://github.com/WWBN/AVideo/commit/e8d6119f3cb1b849149906efeb0a41fc024f59f8", "https://www.vulncheck.com/advisories/avideo-stored-cross-site-scripting-via-unescaped-user-agent-in-participants-panel"], "fixes": [], "products": [{"name": "wwbn/avideo", "path": "vulns/packagist/wwbn%2Favideo", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-56345", "noindex": false, "published": "2026-06-20T18:27:12.134Z", "modified": "2026-06-23T02:38:32.930Z", "cvss": 9.2, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "critical", "epss": 0.00453, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-56345", "title": "AVideo - Arbitrary User Session Hijacking via Meet Plugin uploadRecordedVideo Endpoint", "description": "AVideo through 29.0 contains an authorization bypass vulnerability in the Meet plugin's uploadRecordedVideo.json.php endpoint that derives the target users_id from the uploaded filename without verification. An attacker with knowledge of the Meet shared secret can craft a malicious file upload with a filename containing an arbitrary users_id to invoke passwordless User->login() and establish an authenticated session as any user including admin. Attackers can obtain the Meet shared secret through path-traversal vulnerabilities or timing attacks against checkToken.json.php, then POST a crafted file to uploadRecordedVideo.json.php with a filenam", "references": ["https://github.com/WWBN/AVideo/security/advisories/GHSA-qxvm-r42f-5p8j", "https://www.vulncheck.com/advisories/avideo-arbitrary-user-session-hijacking-via-meet-plugin-uploadrecordedvideo-endpoint", "https://nvd.nist.gov/vuln/detail/CVE-2026-56345"], "fixes": [], "products": [{"name": "wwbn/avideo", "path": "vulns/packagist/wwbn%2Favideo", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-45580", "noindex": false, "published": "2026-05-29T13:14:49.977Z", "modified": "2026-06-02T01:09:49.855Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00136, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-45580", "title": "WWBN AVideo Live: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute", "description": "WWBN AVideo is an open source video platform. In 29.0 and earlier, there is a stored cross-site scripting vulnerability. The Live plugin's \"YouTube-style\" view renders the live transmission's stream key into an HTML class attribute by raw echo, without htmlspecialchars(). A canStream user can persist a key containing \" plus an event handler via plugin/Live/saveLive.php, and any visitor (logged in or anonymous) opening the stream's live page executes attacker JavaScript in the platform origin.", "references": ["https://github.com/WWBN/AVideo/security/advisories/GHSA-m5j4-7r85-2cj2", "https://nvd.nist.gov/vuln/detail/CVE-2026-45580"], "fixes": [], "products": [{"name": "wwbn/avideo", "path": "vulns/packagist/wwbn%2Favideo", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-45578", "noindex": false, "published": "2026-05-29T13:14:02.663Z", "modified": "2026-05-29T14:01:56.851Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00318, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-45578", "title": "WWBN AVideo Live: OS command injection in on_publish.php execAsync via unescaped m3u8 URL", "description": "WWBN AVideo is an open source video platform. In 29.0 and earlier, there is a classic shell-metacharacter injection. The YPTSocket notification branch in plugin/Live/on_publish.php builds an execAsync() command line by string concatenation, single-quoting each argument but never calling escapeshellarg(). A ' in any of the three interpolated values ($users_id, $m3u8, $obj->liveTransmitionHistory_id) closes the quoted token and lets the attacker append arbitrary commands.", "references": ["https://github.com/WWBN/AVideo/security/advisories/GHSA-xw67-cg5f-4m2r", "https://nvd.nist.gov/vuln/detail/CVE-2026-45578"], "fixes": [], "products": [{"name": "wwbn/avideo", "path": "vulns/packagist/wwbn%2Favideo", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-45610", "noindex": false, "published": "2026-05-29T13:13:08.942Z", "modified": "2026-05-29T14:00:05.865Z", "cvss": 5.7, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N", "severity": "medium", "epss": 0.0011, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-45610", "title": "WWBN AVideo plugin/LoginControl/set.json.php: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA", "description": "WWBN AVideo is an open source video platform. In 29.0 and earlier, there is a cross-site request forgery vulnerability on the 2FA toggle. plugin/LoginControl/set.json.php accepts POST type=set2FA value=false, calls LoginControl::setUser2FA(User::getId(), false) on the session-authenticated user, and returns. There is no forbidIfIsUntrustedRequest() call, no isTokenValid() check, no X-CSRF-Token/SameSite enforcement, and no re-authentication step. A cross-origin page that the victim visits while logged into the AVideo dashboard issues the POST via a hidden form (or fetch without credentials:\"omit\") and disables the victim's 2FA in one request.", "references": ["https://github.com/WWBN/AVideo/security/advisories/GHSA-3mv2-vmwh-rwfx", "https://nvd.nist.gov/vuln/detail/CVE-2026-45610"], "fixes": [], "products": [{"name": "wwbn/avideo", "path": "vulns/packagist/wwbn%2Favideo", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-45619", "noindex": false, "published": "2026-05-29T13:11:37.401Z", "modified": "2026-05-29T14:02:31.384Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N", "severity": "medium", "epss": 0.00136, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-45619", "title": "AVideo CVE-2026-43884 incomplete fix - `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD post", "description": "WWBN AVideo is an open source video platform. In 29.0 and earlier, EpgParser.php, plugin/AI/receiveAsync.json.php, and other locations do not use the $resolvedIP out-param of isSSRFSafeURL() for DNS pinning via CURLOPT_RESOLVE, opening DNS-rebinding TOCTOU.", "references": ["https://github.com/WWBN/AVideo/security/advisories/GHSA-c3ch-22rq-xfwr", "https://nvd.nist.gov/vuln/detail/CVE-2026-45619"], "fixes": [], "products": [{"name": "wwbn/avideo", "path": "vulns/packagist/wwbn%2Favideo", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-45620", "noindex": false, "published": "2026-05-29T13:07:19.969Z", "modified": "2026-05-30T02:30:36.945Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00193, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-45620", "title": "AVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumeration", "description": "WWBN AVideo is an open source video platform. In 29.0 and earlier, objects/mention.json.php has no User::loginCheck() or admin gate. It only has an entry guard: preg_match('/^@/', $_REQUEST['term']) and hard-coded rowCount=10. This enables unauthenticated user enumeration.", "references": ["https://github.com/WWBN/AVideo/security/advisories/GHSA-vpfx-pxqw-2w79", "https://nvd.nist.gov/vuln/detail/CVE-2026-45620"], "fixes": [], "products": [{"name": "wwbn/avideo", "path": "vulns/packagist/wwbn%2Favideo", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-45731", "noindex": false, "published": "2026-05-29T13:05:02.855Z", "modified": "2026-05-29T14:03:09.980Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00469, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-45731", "title": "WWBN AVideo: Authenticated Arbitrary File Read in view/update.php", "description": "WWBN AVideo is an open source video platform. In 29.0 and earlier, view/update.php reads $_POST['updateFile'] as a relative path under updatedb/ and passes it to PHP's file() for line-by-line execution as part of a database migration. An authenticated administrator can abuse this to read arbitrary text files reachable from the web-server process.", "references": ["https://github.com/WWBN/AVideo/security/advisories/GHSA-3mjv-375j-6h92", "https://nvd.nist.gov/vuln/detail/CVE-2026-45731"], "fixes": [], "products": [{"name": "wwbn/avideo", "path": "vulns/packagist/wwbn%2Favideo", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-46337", "noindex": false, "published": "2026-05-29T13:03:01.529Z", "modified": "2026-05-29T16:21:29.279Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00455, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-46337", "title": "WWBN AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php`", "description": "WWBN AVideo is an open source video platform. In 29.0 and earlier, an unauthenticated remote attacker can read arbitrary image files anywhere on disk that the PHP user can open — including private user-profile photos that the application's normal serving wrappers gate behind ACLs, admin-uploaded thumbnails, encrypted-video poster frames, and image content under sibling-app directories reachable via .. traversal. The endpoint requires no authentication.", "references": ["https://github.com/WWBN/AVideo/security/advisories/GHSA-w4qq-74h6-58wq", "https://nvd.nist.gov/vuln/detail/CVE-2026-46337"], "fixes": [], "products": [{"name": "wwbn/avideo", "path": "vulns/packagist/wwbn%2Favideo", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-47694", "noindex": false, "published": "2026-05-29T13:00:37.239Z", "modified": "2026-05-30T02:29:30.640Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00162, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-47694", "title": "WWBN AVideo: Stored XSS via unescaped Gallery category description", "description": "WWBN AVideo is an open source video platform. In 29.0 and earlier, AVideo stores category descriptions from user input and later renders category_description as raw HTML in the Gallery view. A user who can create or edit categories can store JavaScript in a category description, which executes when another user views the affected Gallery/category page. This is a stored XSS in the category description field, separate from previously fixed XSS issues in video titles or comments.", "references": ["https://github.com/WWBN/AVideo/security/advisories/GHSA-c8h8-vq34-9fw2", "https://nvd.nist.gov/vuln/detail/CVE-2026-47694"], "fixes": [], "products": [{"name": "wwbn/avideo", "path": "vulns/packagist/wwbn%2Favideo", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-47696", "noindex": false, "published": "2026-05-29T12:59:30.432Z", "modified": "2026-05-29T14:03:52.153Z", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.0012, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-47696", "title": "WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint", "description": "WWBN AVideo is an open source video platform. In 29.0 and earlier, plugin/AuthorizeNet/processPayment.json.php credits the logged-in user's wallet based only on the attacker-controlled amount POST parameter. The endpoint contains a TODO for real Authorize.Net charging, hardcodes $paymentSuccess = true, and then calls YPTWallet::addBalance() without validating\nany Authorize.Net transaction, webhook signature, hosted payment token, nonce, or server-side payment record. This allows any logged-in user to add arbitrary funds to their own AVideo wallet when the AuthorizeNet and YPTWallet plugins are enabled.", "references": ["https://github.com/WWBN/AVideo/security/advisories/GHSA-9392-pj54-qqf8", "https://nvd.nist.gov/vuln/detail/CVE-2026-47696"], "fixes": [], "products": [{"name": "wwbn/avideo", "path": "vulns/packagist/wwbn%2Favideo", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-43885", "noindex": false, "published": "2026-05-11T20:45:21.425Z", "modified": "2026-05-15T18:22:51.524Z", "cvss": 7.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", "severity": "high", "epss": 0.00335, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-43885", "title": "WWBN AVideo: Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization", "description": "WWBN AVideo is an open source video platform. In versions up to and including 29.0, an unauthenticated user can read APISecret from objects/plugins.json.php and use it to call protected API endpoints (e.g. users_list) without logging in. Commit 1c36f229d0a103528fb9f64d0a1cc0e1e8f5999b contains an updated fix.", "references": ["https://github.com/WWBN/AVideo/security/advisories/GHSA-xr49-f4rh-qcjf", "https://github.com/WWBN/AVideo/commit/1c36f229d0a103528fb9f64d0a1cc0e1e8f5999b", "https://nvd.nist.gov/vuln/detail/CVE-2026-43885"], "fixes": [], "products": [{"name": "wwbn/avideo", "path": "vulns/packagist/wwbn%2Favideo", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-43884", "noindex": false, "published": "2026-05-11T20:44:08.261Z", "modified": "2026-05-12T13:22:09.796Z", "cvss": 7.7, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "severity": "high", "epss": 0.00348, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-43884", "title": "WWBN AVideo: SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL()", "description": "WWBN AVideo is an open source video platform. In versions up to and including 29.0, two endpoints (plugin/AI/receiveAsync.json.php and objects/EpgParser.php) in AVideo call isSSRFSafeURL() to validate user-supplied URLs, then fetch them using bare file_get_contents() without disabling PHP's automatic redirect following. An attacker can supply a URL pointing to a server they control that returns a 302 redirect to an internal/cloud-metadata address (e.g., http://169.254.169.254/latest/meta-data/). Since isSSRFSafeURL() only validates the initial URL, the redirect target bypasses all SSRF protections. Commit 603e7bf77a835584387327e35560262feb075", "references": ["https://github.com/WWBN/AVideo/security/advisories/GHSA-2hch-c97c-g99x", "https://github.com/WWBN/AVideo/commit/603e7bf77a835584387327e35560262feb075db3", "https://github.com/WWBN/AVideo/security/advisories/GHSA-2hch-c97c-g99xg"], "fixes": [], "products": [{"name": "wwbn/avideo", "path": "vulns/packagist/wwbn%2Favideo", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-43883", "noindex": false, "published": "2026-05-11T20:41:40.877Z", "modified": "2026-05-12T16:38:42.688Z", "cvss": 4.2, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L", "severity": "medium", "epss": 0.002, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-43883", "title": "WWBN AVideo: IDOR in PayPalYPT agreementCancel.json.php Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription Agreements", "description": "WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/PayPalYPT/agreementCancel.json.php cancels a PayPal billing agreement using an attacker-supplied agreement parameter without verifying that the authenticated user owns the agreement. A low-privilege authenticated user who learns or obtains another user's PayPal billing agreement ID can silently suspend the victim's recurring subscription, causing revenue loss to the platform and loss of paid service to the victim. Commit 0da3dcff1eda2f497694bf82b559829471c292c2 contains an updated fix.", "references": ["https://github.com/WWBN/AVideo/security/advisories/GHSA-958h-qp3x-q4gj", "https://github.com/WWBN/AVideo/commit/0da3dcff1eda2f497694bf82b559829471c292c2", "https://nvd.nist.gov/vuln/detail/CVE-2026-43883"], "fixes": [], "products": [{"name": "wwbn/avideo", "path": "vulns/packagist/wwbn%2Favideo", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-43882", "noindex": false, "published": "2026-05-11T20:40:53.428Z", "modified": "2026-05-13T14:39:21.055Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "severity": "medium", "epss": 0.00214, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-43882", "title": "WWBN AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event Spoofing", "description": "WWBN AVideo is an open source video platform. In versions up to and including 29.0, the unauthenticated plugin/Scheduler/downloadICS.php endpoint passes attacker-controlled title, description, and joinURL parameters into Scheduler::downloadICS(), which builds an ICS calendar file via the ICS helper class. ICS::escape_string() (objects/ICS.php:167-169) only escapes , and ; and does NOT neutralize CR/LF, so attacker CRLF bytes inside a property value break out and inject arbitrary ICS lines — including END:VEVENT / BEGIN:VEVENT pairs that add entire attacker-controlled calendar events. Because the malicious .ics file is served from the victim's", "references": ["https://github.com/WWBN/AVideo/security/advisories/GHSA-mwgh-92m2-wvhv", "https://github.com/WWBN/AVideo/commit/764db592f99e545aa86bb9a4ad664ffd14c38ba5", "https://nvd.nist.gov/vuln/detail/CVE-2026-43882"], "fixes": [], "products": [{"name": "wwbn/avideo", "path": "vulns/packagist/wwbn%2Favideo", "ecosystem": "Packagist"}]}], "total": 49, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 3, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "wwbn/avideo", "path": "vulns/packagist/wwbn%2Favideo", "ecosystem": "Packagist"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": ["29.0", "26.0", "25.0", "24.0", "22.0", "21.0", "18.0", "14.4", "14.3.1", "14.3", "12.4", "11.6"], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-10-08T15:23:31.948Z", "early_advisories": [], "license": "Подборку PatchFirst и наши дополнения (приоритеты, ранние предупреждения, тексты, сводки и агрегаты) можно свободно использовать для собственных целей, включая внутренние задачи бизнеса. Перепродажа, коммерческое распространение и массовое зеркалирование этой подборки или дополнений допускаются только по письменному соглашению с оператором. При любом использовании или публикации подборки или наших дополнений указывайте PatchFirst (https://ru.patchfirst.dev/vulns/) с этой ссылкой на страницу ленты своего региона. Исходные записи открытых источников остаются под их лицензиями и условиями. Эти условия не ограничивают ваши права на исходные данные, которые можно получить у источников напрямую.", "terms_url": "https://ru.patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://ru.patchfirst.dev/vulns/"}, "source_changes": "PatchFirst отбирает, нормализует и объединяет записи; могут добавляться сводки и переводы. Новости указываются ссылкой на первоисточник в самой записи.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Лицензии исходных баз различаются; см. каталог источников."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Оценки доступны свободно; запрашивается указание источника (FIRST EPSS, оценки подготовлены Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}