The WWBN AVideo platform has multiple security vulnerabilities that expose it to potential exploitation by malicious actors.

🚨 EUVD-2026-24284 📊 Score: 6.5/10 (CVSS v3.1) 📦 Product: AVideo 🏢 Vendor: WWBN 📅 Updated: 2026-04-21 📝 WWBN AVideo is an open source video platform. In versions 29.0 and prior, the endpoint `plugin/Live/view/Live_restreams/list.json.php` contains an Insecure Direct Object Reference (IDOR) vulnerability that allows any authenticated user with streaming permission ... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24284 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-24286 📊 Score: 5.3/10 (CVSS v3.1) 📦 Product: AVideo 🏢 Vendor: WWBN 📅 Updated: 2026-04-21 📝 WWBN AVideo is an open source video platform. In versions 29.0 and prior, the file `git.json.php` at the web root executes `git log -1` and returns the full output as JSON to any unauthenticated user. This exposes the exact deployed commit hash (enabling version... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24286 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-24288 📊 Score: 8.7/10 (CVSS v3.1) 📦 Product: AVideo 🏢 Vendor: WWBN 📅 Updated: 2026-04-21 📝 WWBN AVideo is an open source video platform. In versions 29.0 and prior, the locale save endpoint (`locale/save.php`) constructs a file path by directly concatenating `$_POST['flag']` into the path at line 30 without any sanitization. The `$_POST['code']` param... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24288 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-24485 📊 Score: 8.3/10 (CVSS v3.1) 📦 Product: AVideo 🏢 Vendor: WWBN 📅 Updated: 2026-04-21 📝 WWBN AVideo is an open source video platform. In versions 29.0 and prior, `objects/configurationUpdate.json.php` (also routed via `/updateConfig`) persists dozens of global site settings from `$_POST` but protects the endpoint only with `User::isAdmin()`. It doe... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24485 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-24531 📊 Score: 8.1/10 (CVSS v3.1) 📦 Product: AVideo 🏢 Vendor: WWBN 📅 Updated: 2026-04-21 📝 WWBN AVideo is an open source video platform. In versions 29.0 and below, the `allowOrigin($allowAll=true)` function in `objects/functions.php` reflects any arbitrary `Origin` header back in `Access-Control-Allow-Origin` along with `Access-Control-Allow-Credenti... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24531 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-24521 📊 Score: 7.1/10 (CVSS v3.1) 📦 Product: AVideo 🏢 Vendor: WWBN 📅 Updated: 2026-04-21 📝 WWBN AVideo is an open source video platform. In versions 29.0 and prior, three admin-only JSON endpoints — `objects/categoryAddNew.json.php`, `objects/categoryDelete.json.php`, and `objects/pluginRunUpdateScript.json.php` — enforce only a role check (`Category:... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24521 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-24523 📊 Score: 5.4/10 (CVSS v3.1) 📦 Product: AVideo 🏢 Vendor: WWBN 📅 Updated: 2026-04-21 📝 WWBN AVideo is an open source video platform. In versions 29.0 and prior, multiple AVideo JSON endpoints under `objects/` accept state-changing requests via `$_REQUEST`/`$_GET` and persist changes tied to the caller's session user, without any anti-CSRF token, o... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24523 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-24529 📊 Score: 8.6/10 (CVSS v3.1) 📦 Product: AVideo 🏢 Vendor: WWBN 📅 Updated: 2026-04-21 📝 WWBN AVideo is an open source video platform. In versions 29.0 and below, an incomplete SSRF fix in AVideo's LiveLinks proxy adds `isSSRFSafeURL()` validation but leaves DNS TOCTOU vulnerabilities where DNS rebinding between validation and the actual HTTP reques... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24529 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-24537 📊 Score: 7.7/10 (CVSS v3.1) 📦 Product: AVideo 🏢 Vendor: WWBN 📅 Updated: 2026-04-21 📝 WWBN AVideo is an open source video platform. In versions 29.0 and below, the `isSSRFSafeURL()` function in `objects/functions.php` contains a same-domain shortcircuit (lines 4290-4296) that allows any URL whose hostname matches `webSiteRootURL` to bypass all SS... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24537 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-24541 📊 Score: 6.5/10 (CVSS v3.1) 📦 Product: AVideo 🏢 Vendor: WWBN 📅 Updated: 2026-04-21 📝 WWBN AVideo is an open source video platform. In versions 29.0 and below, the directory traversal fix introduced in commit 2375eb5e0 for `objects/aVideoEncoderReceiveImage.json.php` only checks the URL path component (via `parse_url($url, PHP_URL_PATH)`) for `..... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24541 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-24561 📊 Score: 9.3/10 (CVSS v3.1) 📦 Product: AVideo 🏢 Vendor: WWBN 📅 Updated: 2026-04-21 📝 WWBN AVideo is an open source video platform. In versions up to and including 29.0, an incomplete fix for AVideo's `test.php` adds `escapeshellarg` for wget but leaves the `file_get_contents` and `curl` code paths unsanitized, and the URL validation regex `/^htt... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24561 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-24578 📊 Score: 8.9/10 (CVSS v3.1) 📦 Product: AVideo 🏢 Vendor: WWBN 📅 Updated: 2026-04-21 📝 WWBN AVideo is an open source video platform. In versions 29.0 and below, the `cloneServer.json.php` endpoint in the CloneSite plugin constructs shell commands using user-controlled input (`url` parameter) without proper sanitization. The input is directly conca... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24578 #cybersecurity #infosec #euvd #cve #vulnerability