Avideo Encoder
Related 0slug: avideo-encoder
No explanation yet for this tag.
Vulnerabilities related to Avideo Encoder 7
- Medium 4.7 AVideo-Encoder vulnerable to stored DOM cross-site scripting through queue titles AVideo is a video-sharing Platform. Prior to 8.1.0, view/queue.php uses pathinfo on the caller-controlled fileURI and stores its filename through setTitle in encoder_queue.title without neutralization. fileURI is not in the objects/security.php filter lists, and the `Login::canUpload()... CVE-2026-61575
- High 7.5 AVideo-Encoder: pre-authentication streamer-login SQL injection AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated streamer login at objects/login.json.php passes the user parameter to Streamer::get in objects/Streamer.php, where it is interpolated into a single-quoted MariaDB SELECT without parameterization or escaping. Although `ob... CVE-2026-61569
- High 7.3 AVideo-Encoder: missing authentication on control and status endpoints AVideo is a video-sharing Platform. Prior to 8.1.0, the encoder lacks a global authentication layer and exposes control and status PHP endpoints to anonymous network callers. view/run.php has a commented-out guard and invokes Encoder::run(). view/queue.json.php calls Encoder::getAll(true), r... CVE-2026-61571
- High 8.6 AVideo-Encoder: unauthenticated full-response server-side request forgery AVideo is a video-sharing Platform. Before the initial remediation attempt in 8.1.0, url_get_contents in objects/functions.php accepts caller-controlled destinations after only FILTER_VALIDATE_URL syntax validation, without rejecting private, loopback, or link-local addresses, and disables TLS... CVE-2026-61572
- Medium 6.1 AVideo-Encoder: reflected cross-site scripting in the login interface AVideo is a video-sharing Platform. Prior to 8.1.0, the anonymous login interface reflects request values into HTML and JavaScript without output encoding. In view/index.php, webSiteRootURL is returned verbatim by Streamer::getStreamerURL() in objects/Streamer.php and reaches navigation and... CVE-2026-61573
- Critical 10.0 AVideo-Encoder: unauthenticated command execution through streamer login trust AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint view/videosListToLive.php accepts an attacker-named streamer in webSiteRootURL, calls Login::run in objects/Login.php, and trusts the returned JSON as session state. An unauthenticated remote attacker who can hos... CVE-2026-61567
- Critical 10.0 AVideo-Encoder: unauthenticated installer PHP code injection AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint install/checkConfiguration.php assembles videos/configuration.php by interpolating request parameters, including webSiteRootURL, into single-quoted PHP string literals without escaping. An attacker can t... CVE-2026-61564