https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 19 Oct 2026 10:51:48 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-277799 EUVD-2026-277799 https://cve.radiocsirt.org/vuln/euvd-2026-277799 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33759 <p>WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/playlistsVideos.json.php` endpoint returns the full video contents of any playlist by ID without any authentication or authorization check. Private playlists (including `watch_later` and `favorite` types) are correctly hidden from listing endpoints via `playlistsFromUser.json.php`, but their contents are directly accessible through this endpoint by providing the sequential integer `playlists_id` parameter. Commit bb716fbece656c9fe39784f11e4e822b5867f1ca has a patch for the issue.</p> <p>WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/playlistsVideos.json.php` endpoint returns the full video contents of any playlist by ID without any authentication or authorization check. Private playlists (including `watch_later` and `favorite` types) are correctly hidden from listing endpoints via `playlistsFromUser.json.php`, but their contents are directly accessible through this endpoint by providing the sequential integer `playlists_id` parameter. Commit bb716fbece656c9fe39784f11e4e822b5867f1ca has a patch for the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-33759 https://cve.radiocsirt.org/vuln/ghsa-75qq-68m8-pvfr <p><strong>Affected:</strong> Packagist: wwbn/avideo</p> <p>## Summary</p> <p>The `objects/playlistsVideos.json.php` endpoint returns the full video contents of any playlist by ID without any authentication or authorization check. Private playlists (including `watch_later` and `favorite` types) are correctly hidden from listing endpoints via `playlistsFromUser.json.php`, but their contents are directly accessible through this endpoint by providing the sequential integer `playlists_id` parameter.</p> <p>## Details</p> <p>The endpoint at `objects/playlistsVideos.json.php` accepts a `playlists_id` parameter and directly calls `PlayList::getVideosFromPlaylist()` with no ownership or visibility validation:</p> <p>```php // objects/playlistsVideos.json.php:24-28 if (empty($_REQUEST[&#39;playlists_id&#39;])) { die(&#39;Play List can not be empty&#39;); } require_once &#39;./playlist.php&#39;; $videos = PlayList::getVideosFromPlaylist($_REQUEST[&#39;playlists_id&#39;]); ```</p> <p>The `getVideosFromPlaylist()` method at `objects/playlist.php:588` performs a SQL query joining `playlists_has_videos`, `videos`, and `users` tables with no authorization filter:</p> <p>```php // objects/playlist.php:592-597 $sql = &#34;SELECT v.*, p.*,v.created as cre, p.`order` as video_order &#34; . &#34; FROM playlists_has_videos p &#34; . &#34; LEFT JOIN videos as v ON videos_id = v.id &#34; . &#34; LEFT JOIN users u ON u.id = v.users_id &#34; . &#34; WHERE playlists_id = ? AND v.status != &#39;i&#39; &#34;; ```</p> <p>In contrast, the listing endpoint `playlistsFromUser.json.php` correctly enforces visibility at lines 23-27:</p> <p>```php // objects/playlistsFrom…</p> <p><strong>Affected:</strong> Packagist: wwbn/avideo</p> <p>## Summary</p> <p>The `objects/playlistsVideos.json.php` endpoint returns the full video contents of any playlist by ID without any authentication or authorization check. Private playlists (including `watch_later` and `favorite` types) are correctly hidden from listing endpoints via `playlistsFromUser.json.php`, but their contents are directly accessible through this endpoint by providing the sequential integer `playlists_id` parameter.</p> <p>## Details</p> <p>The endpoint at `objects/playlistsVideos.json.php` accepts a `playlists_id` parameter and directly calls `PlayList::getVideosFromPlaylist()` with no ownership or visibility validation:</p> <p>```php // objects/playlistsVideos.json.php:24-28 if (empty($_REQUEST[&#39;playlists_id&#39;])) { die(&#39;Play List can not be empty&#39;); } require_once &#39;./playlist.php&#39;; $videos = PlayList::getVideosFromPlaylist($_REQUEST[&#39;playlists_id&#39;]); ```</p> <p>The `getVideosFromPlaylist()` method at `objects/playlist.php:588` performs a SQL query joining `playlists_has_videos`, `videos`, and `users` tables with no authorization filter:</p> <p>```php // objects/playlist.php:592-597 $sql = &#34;SELECT v.*, p.*,v.created as cre, p.`order` as video_order &#34; . &#34; FROM playlists_has_videos p &#34; . &#34; LEFT JOIN videos as v ON videos_id = v.id &#34; . &#34; LEFT JOIN users u ON u.id = v.users_id &#34; . &#34; WHERE playlists_id = ? AND v.status != &#39;i&#39; &#34;; ```</p> <p>In contrast, the listing endpoint `playlistsFromUser.json.php` correctly enforces visibility at lines 23-27:</p> <p>```php // objects/playlistsFrom…</p> https://cve.radiocsirt.org/vuln/ghsa-75qq-68m8-pvfr