CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 2CVE-2023-30854 – WWBN AVideo vulnerable to OS Command Injection
https://notcve.org/view.php?id=CVE-2023-30854
AVideo is an open source video platform. Prior to version 12.4, an OS Command Injection vulnerability in an authenticated endpoint `/plugin/CloneSite/cloneClient.json.php` allows attackers to achieve Remote Code Execution. This issue is fixed in version 12.4. • https://github.com/jmrcsnchz/CVE-2023-30854 https://github.com/WWBN/AVideo/security/advisories/GHSA-6vrj-ph27-qfp3 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-25313
https://notcve.org/view.php?id=CVE-2023-25313
OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbitrary code via the video link field to the Embed a video link feature. • https://github.com/WWBN/AVideo/security/advisories/GHSA-pgvh-p3g4-86jw • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-25314
https://notcve.org/view.php?id=CVE-2023-25314
Cross Site Scripting (XSS) vulnerability in World Wide Broadcast Network AVideo before 12.4, allows attackers to gain sensitive information via the success parameter to /user. • https://github.com/WWBN/AVideo/commit/2b44dee815b208da85e1dcafa9839391c3de2655 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-34652
https://notcve.org/view.php?id=CVE-2022-34652
A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the Live Schedules plugin, allowing an attacker to inject SQL by manipulating the description parameter. Se presenta una vulnerabilidad de inyección sql en la funcionalidad ObjectYPT de WWBN AVideo versiones 11.6 y dev master commit 3f7c0364. Una petición HTTP especialmente diseñada puede conllevar a una inyección SQL. • https://github.com/WWBN/AVideo/blob/e04b1cd7062e16564157a82bae389eedd39fa088/updatedb/updateDb.v12.0.sql https://talosintelligence.com/vulnerability_reports/TALOS-2022-1551 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-33149
https://notcve.org/view.php?id=CVE-2022-33149
A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the CloneSite plugin, allowing an attacker to inject SQL by manipulating the url parameter. Se presenta una vulnerabilidad de inyección sql en la funcionalidad ObjectYPT de WWBN AVideo versiones 11.6 y dev master commit 3f7c0364. Una petición HTTP especialmente diseñada puede conllevar a una inyección SQL. • https://github.com/WWBN/AVideo/blob/e04b1cd7062e16564157a82bae389eedd39fa088/updatedb/updateDb.v12.0.sql https://talosintelligence.com/vulnerability_reports/TALOS-2022-1551 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •