WWBN AVideo vulnerabilities

WWBN AVideo is an open source video platform that, in versions up to 29.0, allows unauthenticated users to read APISecret from objects/plugins.json.php. This enables them to call protected API endpoints, such as users_list, without logging in.

WWBN AVideo versions 29.0 and below are vulnerable to OS command injection. The fix for CVE-2026-33482 was incomplete and does not neutralize a single & (shell background operator), allowing multiple commands to be chained.

In WWBN AVideo prior to version 29.0, a vulnerability in the Authorize.Net webhook handler allows an attacker to bypass signature verification and forge webhook requests with arbitrary payment amounts and target user IDs. The attacker can credit arbitrary wallet balances to any user without a corresponding payment and activate premium subscriptions, leading to free access to paid content and direct revenue loss.

A privilege escalation vulnerability in WWBN AVideo prior to version 29.0 allows any user who can solve a CAPTCHA to self-grant elevated permissions during registration via unguarded API parameters. Attackers can mark accounts as email-verified and obtain upload, streaming, and meeting creation rights.

In WWBN AVideo version 29.0 and earlier, the endpoint plugin/AuthorizeNet/processPayment.json.php credits the user's wallet based solely on the attacker-controlled amount parameter, without validating any Authorize.Net transaction. This allows any logged-in user to add arbitrary funds to their AVideo wallet.

WWBN AVideo in version 29.0 and earlier stores category descriptions from user input and renders them as raw HTML in the Gallery view. A user who can create or edit categories can store JavaScript in a category description, which executes when another user views the affected page. This is a stored XSS vulnerability in the category description field.

WWBN AVideo is an open source video platform. In 29.0 and earlier, an unauthenticated remote attacker can read arbitrary image files anywhere on disk that the PHP user can open — including private user-profile photos that the application's normal serving wrappers gate behind ACLs, admin-uploaded thumbnails, encrypted-video poster frames, and image content under sibling-app directories reachable via .. traversal. The endpoint requires no authentication.

In WWBN AVideo (version 29.0 and earlier), view/update.php reads $_POST['updateFile'] as a relative path under updatedb/ and passes it to PHP's file() for line-by-line execution as part of a database migration. An authenticated administrator can abuse this to read arbitrary text files reachable from the web-server process.

In WWBN AVideo 29.0 and earlier, the file objects/mention.json.php lacks authentication checks or an admin gate. It only has a simple entry guard: preg_match('/^@/', $_REQUEST['term']) and a hard-coded rowCount=10. This allows unauthenticated user enumeration.

WWBN AVideo in version 29.0 and earlier does not use the $resolvedIP out-param of isSSRFSafeURL() for DNS pinning via CURLOPT_RESOLVE in EpgParser.php, plugin/AI/receiveAsync.json.php, and other locations. This opens a DNS-rebinding TOCTOU vulnerability.

WWBN AVideo version 29.0 and earlier contains a cross-site request forgery (CSRF) vulnerability in the 2FA toggle. An attacker can use a hidden form or fetch request without credentials to disable the victim's 2FA with a single POST request.

WWBN AVideo in version 29.0 and earlier has a stored cross-site scripting vulnerability in the Live plugin. The YouTube-style view renders the live stream key into an HTML class attribute by raw echo, without htmlspecialchars(). A canStream user can persist a key containing " plus an event handler via plugin/Live/saveLive.php, and any visitor opening the stream's page executes attacker JavaScript in the platform origin.

WWBN AVideo up to version 26.0 allows an authenticated uploader to bypass SSRF validation via controlled downloadURL values with extensions .mp4, .mp3, .zip, .jpg, .png, .gif, .webm. The server fetches and stores the response as media, enabling SSRF response exfiltration.

In WWBN AVideo versions 26.0 and prior, the plugin/CloneSite/client.log.php endpoint serves the clone operation log file without any authentication. Other endpoints in the CloneSite directory require admin privileges. The log contains internal filesystem paths, remote server URLs, and SSH connection metadata.

In WWBN AVideo versions 26.0 and prior, the plugin/API/check.ffmpeg.json.php endpoint probes the FFmpeg remote server configuration and returns connectivity status without any authentication. Other FFmpeg management endpoints require admin privileges.

In WWBN AVideo versions 26.0 and prior, the install/test.php diagnostic script has its CLI-only access guard disabled by commenting out the die() statement. The script remains accessible via HTTP after installation, exposing video viewer statistics including IP addresses, session IDs, and user agents to unauthenticated visitors.

WWBN AVideo versions 26.0 and prior have a vulnerability in the BlockonomicsYPT plugin's check.php endpoint. The endpoint returns payment order data for any Bitcoin address without requiring authentication, allowing an attacker to query payment records for any address used on the platform.

WWBN AVideo in versions 26.0 and prior contains a Cross-Site Request Forgery (CSRF) vulnerability in the player skin configuration endpoint at admin/playerUpdate.json.php because it does not validate CSRF tokens. The plugins table is explicitly excluded from the ORM's domain-based security check via ignoreTableSecurityCheck(), removing the only other layer of defense. Combined with SameSite=None cookies, a cross-origin POST can modify the video player appearance on the entire platform.

WWBN AVideo open source video platform versions 26.0 and earlier have a CSRF vulnerability in the site customization endpoint. It lacks CSRF token validation and writes uploaded logo files before ORM security checks, allowing cross-origin POST to overwrite the logo.

WWBN AVideo up to version 26.0 has a vulnerability in the SocialMediaPublisher plugin where the publishInstagram.json.php endpoint acts as an unauthenticated proxy to the Facebook/Instagram Graph API. This allows any unauthenticated user to make arbitrary Graph API calls through the server, potentially using stolen tokens or abusing the platform's own credentials.

WWBN AVideo versions 26.0 and prior have an SSRF vulnerability in the EPG (Electronic Program Guide) feature. Authenticated users with upload permissions can store arbitrary URLs that the server fetches on every EPG page visit. Insufficient URL validation allows scanning internal networks and accessing internal services.

WWBN AVideo up to version 26.0 has a vulnerability in the User_Location plugin's testIP.php page that reflects the ip parameter without output encoding, allowing arbitrary HTML and JavaScript injection. Although the page is restricted to admins, the SameSite=None cookie configuration allows cross-origin exploitation. No public patches are available.

WWBN AVideo versions 26.0 and prior accept an overrideStatus request parameter that allows any uploader to set a video's status to any valid state, including "active" (a). This bypasses admin-controlled moderation and draft workflows. The setStatus() method does not verify that the caller has permission to set that particular status.

WWBN AVideo versions 26.0 and prior have a vulnerability in the StripeYPT plugin. The test.php endpoint is accessible to any logged-in user, not just administrators. Due to a bug in the retrieveSubscriptions() method that cancels subscriptions instead of retrieving them, any authenticated user can cancel arbitrary Stripe subscriptions by providing a subscription ID.

WWBN AVideo versions 26.0 and prior have a vulnerability in the CreatePlugin template for list.json.php, which lacks authentication or authorization checks. This results in 21 unauthenticated endpoints exposing sensitive data including user PII, payment transaction logs, IP addresses, and user agents.

WWBN AVideo versions 26.0 and prior have a vulnerability in the on_publish_done.php endpoint in the Live plugin that allows unauthenticated users to terminate any active live stream. An attacker can enumerate stream keys from the stats.json.php endpoint and send crafted POST requests to stop broadcasts.

WWBN AVideo versions 26.0 and prior have an XSS vulnerability in the YPTSocket plugin. The caller feature passes the caller's display name directly as raw HTML into the jQuery Toast Plugin. An attacker can set their display name to an XSS payload, and upon initiating a call, the code executes in any online user's browser without interaction.

WWBN AVideo allows admins to enable/disable plugins via objects/pluginSwitch.json.php without CSRF validation and bypassing Referer/Origin checks. An attacker can disable critical security plugins (e.g., 2FA) by luring an admin to a malicious page.

WWBN AVideo version 26.0 and prior allows admins to send HTML emails to all users via the objects/emailAllUsers.json.php endpoint. No CSRF token validation and SameSite=None on session cookies enable cross-origin CSRF attacks.

WWBN AVideo versions 26.0 and prior do not encode plugin configuration values before rendering in the admin panel. The jsonToFormElements() function in admin/functions.php directly interpolates user data into HTML elements, allowing arbitrary JavaScript injection.

WWBN AVideo versions 26.0 and prior have a vulnerability in the endpoint plugin/YPTWallet/view/users.json.php, which returns personal information and wallet balances of all users to any authenticated user. There is no admin privilege check.

WWBN AVideo up to version 26.0 lacks CSRF token validation in the admin plugin configuration endpoint (admin/save.json.php). Combined with SameSite=None cookie policy, an attacker can forge cross-origin POST requests to overwrite arbitrary plugin settings on an admin session. Bypassing table-level access controls allows full platform takeover.