https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 18:43:52 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-277255 EUVD-2026-277255 https://cve.radiocsirt.org/vuln/euvd-2026-277255 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33512 <p>WWBN AVideo is an open source video platform. In versions up to and including 26.0, the API plugin exposes a `decryptString` action without any authentication. Anyone can submit ciphertext and receive plaintext. Ciphertext is issued publicly (e.g., `view/url2Embed.json.php`), so any user can recover protected tokens/metadata. Commit 3fdeecef37bb88967a02ccc9b9acc8da95de1c13 contains a patch.</p> <p>WWBN AVideo is an open source video platform. In versions up to and including 26.0, the API plugin exposes a `decryptString` action without any authentication. Anyone can submit ciphertext and receive plaintext. Ciphertext is issued publicly (e.g., `view/url2Embed.json.php`), so any user can recover protected tokens/metadata. Commit 3fdeecef37bb88967a02ccc9b9acc8da95de1c13 contains a patch.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-33512 https://cve.radiocsirt.org/vuln/ghsa-mwjc-5j4x-r686 <p><strong>Affected:</strong> Packagist: wwbn/avideo</p> <p>### Summary The API plugin exposes a `decryptString` action without any authentication. Anyone can submit ciphertext and receive plaintext. Ciphertext is issued publicly (e.g., `view/url2Embed.json.php`), so any user can recover protected tokens/metadata. Severity: High.</p> <p>### Details - Entry: `plugin/API/get.json.php` is unauthenticated. - Handler: `plugin/API/API.php` `get_api_decryptString()` (lines ~5945–5966): ```php $string = decryptString($_REQUEST[&#39;string&#39;]); return new ApiObject($string, empty($string)); ``` No APISecret or user check occurs before decrypting. - Public ciphertext source: `view/url2Embed.json.php` returns `playLink`/`playEmbedLink` (`encryptString(json_encode(...))`) to any caller.</p> <p>### PoC 1. Obtain ciphertext: ``` GET /view/url2Embed.json.php?url=https://example.com/video.mp4 ``` Copy `playLink`. 2. Decrypt without auth: ``` POST /plugin/API/get.json.php?APIName=decryptString Content-Type: application/x-www-form-urlencoded</p> <p>string=&lt;playLink ciphertext&gt; ``` Response contains the plaintext JSON (videoLink, title, users_id, etc.).</p> <p>### Impact - Any encrypted payload produced by the platform can be decrypted by anyone. - Leaks tokens/links intended to be confidential; enables replay and tampering where secrecy was assumed.</p> <p>### Mitigation - Require API secret or authenticated/authorized user for `decryptString`, or remove the endpoint. - Prefer one-way signatures (HMAC) instead of exposing generic decryption. - Ro…</p> <p><strong>Affected:</strong> Packagist: wwbn/avideo</p> <p>### Summary The API plugin exposes a `decryptString` action without any authentication. Anyone can submit ciphertext and receive plaintext. Ciphertext is issued publicly (e.g., `view/url2Embed.json.php`), so any user can recover protected tokens/metadata. Severity: High.</p> <p>### Details - Entry: `plugin/API/get.json.php` is unauthenticated. - Handler: `plugin/API/API.php` `get_api_decryptString()` (lines ~5945–5966): ```php $string = decryptString($_REQUEST[&#39;string&#39;]); return new ApiObject($string, empty($string)); ``` No APISecret or user check occurs before decrypting. - Public ciphertext source: `view/url2Embed.json.php` returns `playLink`/`playEmbedLink` (`encryptString(json_encode(...))`) to any caller.</p> <p>### PoC 1. Obtain ciphertext: ``` GET /view/url2Embed.json.php?url=https://example.com/video.mp4 ``` Copy `playLink`. 2. Decrypt without auth: ``` POST /plugin/API/get.json.php?APIName=decryptString Content-Type: application/x-www-form-urlencoded</p> <p>string=&lt;playLink ciphertext&gt; ``` Response contains the plaintext JSON (videoLink, title, users_id, etc.).</p> <p>### Impact - Any encrypted payload produced by the platform can be decrypted by anyone. - Leaks tokens/links intended to be confidential; enables replay and tampering where secrecy was assumed.</p> <p>### Mitigation - Require API secret or authenticated/authorized user for `decryptString`, or remove the endpoint. - Prefer one-way signatures (HMAC) instead of exposing generic decryption. - Ro…</p> https://cve.radiocsirt.org/vuln/ghsa-mwjc-5j4x-r686