https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 14 Oct 2026 16:23:30 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-276712 EUVD-2026-276712 https://cve.radiocsirt.org/vuln/euvd-2026-276712 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33038 <p>WWBN AVideo is an open source video platform. Versions 25.0 and below are vulnerable to unauthenticated application takeover through the install/checkConfiguration.php endpoint. install/checkConfiguration.php performs full application initialization: database setup, admin account creation, and configuration file write, all from an unauthenticated POST input. The only guard is checking whether videos/configuration.php already exists. On uninitialized deployments, any remote attacker can complete the installation with attacker-controlled credentials and an attacker-controlled database, gaining full administrative access. This issue has been fixed in version 26.0.</p> <p>WWBN AVideo is an open source video platform. Versions 25.0 and below are vulnerable to unauthenticated application takeover through the install/checkConfiguration.php endpoint. install/checkConfiguration.php performs full application initialization: database setup, admin account creation, and configuration file write, all from an unauthenticated POST input. The only guard is checking whether videos/configuration.php already exists. On uninitialized deployments, any remote attacker can complete the installation with attacker-controlled credentials and an attacker-controlled database, gaining full administrative access. This issue has been fixed in version 26.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-33038 https://cve.radiocsirt.org/vuln/ghsa-2f9h-23f7-8gcx <p><strong>Affected:</strong> Packagist: wwbn/avideo</p> <p>## Summary The `install/checkConfiguration.php` endpoint performs full application initialization — database setup, admin account creation, and configuration file write — from unauthenticated POST input. The only guard is checking whether `videos/configuration.php` already exists. On uninitialized deployments, any remote attacker can complete the installation with attacker-controlled credentials and an attacker-controlled database, gaining full administrative access.</p> <p>## Affected Component - `install/checkConfiguration.php` — entire file (lines 1-273)</p> <p>## Description</p> <p>### No authentication or access restriction on installer endpoint</p> <p>The `checkConfiguration.php` file performs the most privileged operations in the application — creating the database schema, the admin account, and the configuration file — with no authentication, no setup token, no CSRF protection, and no IP restriction. The sole guard is a file-existence check:</p> <p>```php // install/checkConfiguration.php — lines 2-5 if (file_exists(&#34;../videos/configuration.php&#34;)) { error_log(&#34;Can not create configuration again: &#34;. json_encode($_SERVER)); exit; } ```</p> <p>If `videos/configuration.php` does not exist (fresh deployment, container restart without persistent storage, re-deployment), the entire installer runs with attacker-controlled POST parameters.</p> <p>### Attacker-controlled database host eliminates credential guessing</p> <p>Unlike typical installer exposure vulnerabilities where the attacker must guess the target&#39;s d…</p> <p><strong>Affected:</strong> Packagist: wwbn/avideo</p> <p>## Summary The `install/checkConfiguration.php` endpoint performs full application initialization — database setup, admin account creation, and configuration file write — from unauthenticated POST input. The only guard is checking whether `videos/configuration.php` already exists. On uninitialized deployments, any remote attacker can complete the installation with attacker-controlled credentials and an attacker-controlled database, gaining full administrative access.</p> <p>## Affected Component - `install/checkConfiguration.php` — entire file (lines 1-273)</p> <p>## Description</p> <p>### No authentication or access restriction on installer endpoint</p> <p>The `checkConfiguration.php` file performs the most privileged operations in the application — creating the database schema, the admin account, and the configuration file — with no authentication, no setup token, no CSRF protection, and no IP restriction. The sole guard is a file-existence check:</p> <p>```php // install/checkConfiguration.php — lines 2-5 if (file_exists(&#34;../videos/configuration.php&#34;)) { error_log(&#34;Can not create configuration again: &#34;. json_encode($_SERVER)); exit; } ```</p> <p>If `videos/configuration.php` does not exist (fresh deployment, container restart without persistent storage, re-deployment), the entire installer runs with attacker-controlled POST parameters.</p> <p>### Attacker-controlled database host eliminates credential guessing</p> <p>Unlike typical installer exposure vulnerabilities where the attacker must guess the target&#39;s d…</p> https://cve.radiocsirt.org/vuln/ghsa-2f9h-23f7-8gcx