CVE-2026-43877 is a Cross-Site Request Forgery (CSRF) vulnerability in WWBN AVideo versions up to and including 29.0. The vulnerability exists in the legacy endpoint objects/userSavePhoto.php, which allows a logged-in user’s profile photo to be overwritten with arbitrary data via a base64 POST parameter. This endpoint lacks CSRF protections such as tokens, Origin/Referer checks, and MIME validation. Due to the platform's cookie policy (SameSite=None; Secure on HTTPS), an attacker can exploit this by tricking a logged-in user into visiting a malicious page, causing unauthorized profile photo changes and triggering a site-wide cache clear. No official patch or remediation level is confirmed in the provided data, though a commit referenced in the description suggests a fix was made. The CVSS score is 5.4, indicating medium severity.
WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/notifySubscribers.json.php takes the raw message POST parameter and passes it into sendSiteEmail(), which substitutes it directly into an HTML email template (via str_replace on the {message} placeholder) and renders it with PHPMailer::msgHTML(). There is no HTML sanitization, character escaping, or output encoding on the attacker-controlled message between $_POST['message'] and the rendered email. Any authenticated user with upload permission can therefore broadcast arbitrary HTML — phishing links, tracking pixels, CSS/UI spoofing — to every subscriber on their channel (up to 10,000 recipients per invocation). The email is sent From: the platform's configured contact address and wrapped in the site's official logo and title, so attacker-supplied HTML arrives with the appearance of an official platform communication. Commit https://github.com/WWBN/AVideo/commit/ contains an updated fix.
WWBN AVideo versions up to and including 29.0 have a vulnerability where an OAuth login redirect URL exposes the victim's stored password hash in a GET request query string. This hash is equivalent to a plaintext credential due to the application's login logic, allowing an attacker who captures the URL to fully take over the account, including admin accounts. The vulnerability is tracked as CVE-2026-43875 with a CVSS score of 6.8 (medium severity). A code commit (977cd6930a97571a26da4239e25c8096dd4ecbc1) contains a fix, but no official patch or vendor advisory is provided in the data. The product is not a cloud service, so remediation depends on applying the fix manually.
CVE-2026-43873 is a vulnerability in WWBN AVideo versions up to and including 29.0 where an unauthenticated error message leaks a sensitive CloneSite shared secret key. This key is echoed in the HTTP response body on unauthenticated requests to cloneClient.json.php. The leaked key can be used by an attacker to impersonate the victim on a remote CloneSite server and trigger a full database dump to a publicly accessible directory. This vulnerability is classified as CWE-209 (generation of error message containing sensitive information) and has a CVSS score of 7.5, indicating high severity.
CVE-2026-43874 is a high-severity code injection vulnerability in WWBN AVideo versions up to and including 29.0. The issue arises because the server-side mitigation for a previous vulnerability (CVE-2026-40911) only strips malicious payloads in a specific JSON field ($json['msg']), but the relay function uses a different field ($msg['json']) to select outbound messages. An unauthenticated attacker can obtain a WebSocket token, connect to the WebSocket server, and send a specially crafted message that bypasses the stripping mechanism. This message is then relayed verbatim to logged-in users and executed via eval() on the client side, enabling code injection. There is a commit referenced that contains an updated fix, but no official patch or vendor advisory is provided in the data.
CVE-2026-41304 is a command injection vulnerability in WWBN AVideo versions 29.0 and below. The vulnerability exists in the CloneSite plugin's cloneServer.json.php endpoint, where user input from the 'url' parameter is unsafely concatenated into a shell command executed via exec(). This allows an attacker to inject arbitrary shell commands, leading to remote code execution on the server. A fix for this issue is included in commit 473c609fc2defdea8b937b00e86ce88eba1f15bb.
CVE-2026-41064 is a critical OS command injection vulnerability in WWBN AVideo versions up to and including 29.0. The issue arises from an incomplete fix in the test.php script where only the wget command path is sanitized using escapeshellarg, but the file_get_contents and curl code paths remain unsanitized. Additionally, the URL validation regex is insufficient, allowing malformed URLs like 'httpevil.com' to bypass checks. This vulnerability has a high CVSS score of 9.3, indicating a severe risk of remote exploitation without authentication. A commit (78bccae74634ead68aa6528d631c9ec4fd7aa536) contains an updated fix, but no official patch or vendor advisory is provided in the data. No known exploits in the wild have been reported at this time.
CVE-2026-41063 is a medium severity cross-site scripting (XSS) vulnerability in WWBN AVideo versions 29.0 and below. The issue arises from an incomplete fix in the ParsedownSafeWithLinks class, where certain markdown link syntaxes with javascript: URLs bypass sanitization. This allows an attacker to inject malicious scripts via crafted markdown links. The vulnerability impacts confidentiality and integrity but does not affect availability. No official patch or remediation level has been confirmed in the provided data.
CVE-2026-41062 is a path traversal vulnerability in WWBN AVideo versions 29.0 and below. The vulnerability arises because the fix for directory traversal only inspects the URL path component for '.. ' sequences, but the downstream function processes the full URL including the query string. This allows an attacker to bypass the check by placing traversal payloads in the query string, potentially reading arbitrary files on the server. The issue is addressed in a later commit (bd11c16ec894698e54e2cdae25026c61ad1ed441). The CVSS score is 6.5, indicating medium severity, with impact limited to confidentiality loss without integrity or availability impact. No official patch or vendor advisory is currently provided in the data.
CVE-2026-41061 is a stored cross-site scripting (XSS) vulnerability in WWBN AVideo versions 29.0 and below. The issue arises from an improper regex validation in the isValidDuration() function, which allows arbitrary HTML/JavaScript to be appended after a valid duration prefix. This crafted input is stored in the database and rendered without HTML escaping on various pages, including trending, playlist, and video gallery thumbnails. A fix for this vulnerability is available in commit bcba324644df8b4ed1f891462455f1cd26822a45.
CVE-2026-41060 is a Server-Side Request Forgery (SSRF) vulnerability in WWBN AVideo versions 29.0 and below. The vulnerability arises from the isSSRFSafeURL() function, which incorrectly allows URLs with the same hostname as the site to bypass SSRF protections regardless of port. This enables attackers to access arbitrary ports on the AVideo server. The response from such requests is saved to a web-accessible location, allowing attackers to exfiltrate data. A fix for this issue is available in commit a0156a6398362086390d949190f9d52a823000ba.
CVE-2026-41058 is a path traversal vulnerability in WWBN AVideo versions 29.0 and below. The issue arises from an incomplete fix in the CloneSite feature's deleteDump parameter, which fails to properly filter path traversal sequences. This allows an attacker with low privileges to use '.. /' sequences in a GET parameter to unlink arbitrary files on the server. An updated fix addressing this vulnerability is referenced in commit 3c729717c26f160014a5c86b0b6accdbd613e7b2. The vulnerability has a high severity score of 8.1 but no known exploits in the wild have been reported as of now.
WWBN AVideo versions 29.0 and below have an origin validation vulnerability in their CORS implementation. The incomplete fix for CORS origin validation allows arbitrary Origin headers with credentials to be accepted on all /api/* endpoints. This enables an attacker to perform cross-origin credentialed requests and read authenticated responses containing sensitive user information such as PII, email, admin status, and session data. A fix is available in commit 5e2b897ccac61eb6daca2dee4a6be3c4c2d93e13, but no official patch release information is provided yet.
WWBN AVideo versions 29.0 and below contain a permissive cross-domain policy vulnerability in the allowOrigin function that reflects arbitrary Origin headers in Access-Control-Allow-Origin with credentials allowed. This affects key API endpoints handling user data and authentication. Combined with the SameSite=None cookie policy, this enables any website to perform credentialed cross-origin requests, potentially exposing user PII, livestream keys, and allowing unauthorized state changes. A fix is committed but no official patch release or advisory is confirmed yet.
CVE-2026-41055 is a high-severity Server-Side Request Forgery (SSRF) vulnerability in WWBN AVideo versions 26.0 and below. The vulnerability arises from an incomplete fix in the LiveLinks proxy where the isSSRFSafeURL() validation is bypassed due to a DNS Time-Of-Check to Time-Of-Use (TOCTOU) issue. This allows an attacker to exploit DNS rebinding between validation and the actual HTTP request, potentially redirecting traffic to internal endpoints. An updated fix addressing this issue is contained in commit 8d8fc0cadb425835b4861036d589abcea4d78ee8. There is no official vendor advisory or patch link provided, and no known exploits in the wild have been reported.
WWBN AVideo versions 29.0 and earlier contain a vulnerability in the CAPTCHA implementation where the CAPTCHA length can be set by an unauthenticated client without validation, allowing generation of a 1-character CAPTCHA. Because the CAPTCHA comparison is case-insensitive over a limited alphabet and failed attempts do not consume the session token, an attacker can brute-force the CAPTCHA in about 33 attempts per session. This affects any endpoint relying on Captcha::validation(), such as user registration and password recovery. A fix is available in commit bf1c76989e6a9054be4f0eb009d68f0f2464b453, but no official vendor advisory or patch release is referenced.
WWBN AVideo versions 29.0 and prior contain a Cross-Site Request Forgery (CSRF) vulnerability in the comment deletion endpoint. The endpoint 'objects/commentDelete.json.php' allows authenticated users with deletion privileges to delete comments without any CSRF protections such as token validation or origin checks. Because the platform sets session cookies with SameSite=None, cross-origin requests automatically include the session cookie, enabling attackers to trick authorized users into deleting comments by visiting malicious pages. A fix for this vulnerability is referenced in a specific commit but no official patch release information is provided.
WWBN AVideo versions 29.0 and earlier contain multiple JSON endpoints vulnerable to Cross-Site Request Forgery (CSRF). These endpoints accept state-changing requests without anti-CSRF protections such as tokens or origin checks. An attacker can cause a logged-in user to perform actions like liking/disliking comments, posting comments with attacker-chosen text, or deleting assets if the user has category management rights, simply by having the user load a malicious webpage. A fix has been committed but no official patch release information is provided.
WWBN AVideo versions 29.0 and earlier contain a Cross-Site Request Forgery (CSRF) vulnerability in three admin-only JSON endpoints that modify categories and run plugin update scripts. These endpoints enforce only role checks without validating CSRF tokens, allowing an attacker to perform unauthorized state-changing actions if an admin visits a malicious page. A fix has been committed but no official patch release or advisory is confirmed yet. The vulnerability has a CVSS score of 7.1, indicating high severity due to the potential for unauthorized modification of categories and plugin execution.
WWBN AVideo is an open source video platform. In versions 29.0 and prior, `objects/configurationUpdate.json.php` (also routed via `/updateConfig`) persists dozens of global site settings from `$_POST` but protects the endpoint only with `User::isAdmin()`. It does not call `forbidIfIsUntrustedRequest()`, does not verify a `globalToken`, and does not validate the Origin/Referer header. Because AVideo intentionally sets `session.cookie_samesite=None` to support cross-origin iframe embedding, a logged-in administrator who visits an attacker-controlled page will have the browser auto-submit a cross-origin POST that rewrites the site's encoder URL, SMTP credentials, site `<head>` HTML, logo, favicon, contact email, and more in a single request. Commit f9492f5e6123dff0292d5bb3164fde7665dc36b4 contains a fix.