https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T05:33:28.712759+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-63305 CVE-2026-63305 — AVideo through 29.0 OS Command Injection via ffmpeg.json.php 2026-10-07T05:33:28.728219+00:00

Affected: WWBN AVideo

AVideo through 29.0 contains an OS command injection vulnerability in the ffmpeg.json.php endpoint where notifyCode and callback parameters are concatenated into a shell command without escaping. Attackers who can craft a valid encrypted payload can inject arbitrary shell metacharacters into these fields to execute OS commands as the web-server user.