https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 19 Oct 2026 10:52:07 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-277831 EUVD-2026-277831 https://cve.radiocsirt.org/vuln/euvd-2026-277831 https://cve.radiocsirt.org/vuln/fkie_cve-2026-34247 <p>WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `plugin/Live/uploadPoster.php` endpoint allows any authenticated user to overwrite the poster image for any scheduled live stream by supplying an arbitrary `live_schedule_id`. The endpoint only checks `User::isLogged()` but never verifies that the authenticated user owns the targeted schedule. After overwriting the poster, the endpoint broadcasts a `socketLiveOFFCallback` notification containing the victim&#39;s broadcast key and user ID to all connected WebSocket clients. Commit 5fcb3bdf59f26d65e203cfbc8a685356ba300b60 fixes the issue.</p> <p>WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `plugin/Live/uploadPoster.php` endpoint allows any authenticated user to overwrite the poster image for any scheduled live stream by supplying an arbitrary `live_schedule_id`. The endpoint only checks `User::isLogged()` but never verifies that the authenticated user owns the targeted schedule. After overwriting the poster, the endpoint broadcasts a `socketLiveOFFCallback` notification containing the victim&#39;s broadcast key and user ID to all connected WebSocket clients. Commit 5fcb3bdf59f26d65e203cfbc8a685356ba300b60 fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-34247 https://cve.radiocsirt.org/vuln/ghsa-g3hj-mf85-679g <p><strong>Affected:</strong> Packagist: wwbn/avideo</p> <p>## Summary</p> <p>The `plugin/Live/uploadPoster.php` endpoint allows any authenticated user to overwrite the poster image for any scheduled live stream by supplying an arbitrary `live_schedule_id`. The endpoint only checks `User::isLogged()` but never verifies that the authenticated user owns the targeted schedule. After overwriting the poster, the endpoint broadcasts a `socketLiveOFFCallback` notification containing the victim&#39;s broadcast key and user ID to all connected WebSocket clients.</p> <p>## Details</p> <p>The vulnerable endpoint at `plugin/Live/uploadPoster.php` accepts a `live_schedule_id` from `$_REQUEST` and uses it to determine poster file paths and trigger socket notifications without ownership validation.</p> <p>**Entry point — attacker-controlled input (line 11-12):** ```php $live_servers_id = intval($_REQUEST[&#39;live_servers_id&#39;]); $live_schedule_id = intval($_REQUEST[&#39;live_schedule_id&#39;]); ```</p> <p>**Insufficient auth check (line 14-17):** ```php if (!User::isLogged()) { $obj-&gt;msg = &#39;You cant edit this file&#39;; die(json_encode($obj)); } ```</p> <p>This only verifies the user is logged in. There is no check that `User::getId()` matches the schedule owner&#39;s `users_id`.</p> <p>**Poster path resolved by ID alone (line 40-42):** ```php $paths = Live_schedule::getPosterPaths($live_schedule_id, 0); $obj-&gt;file = str_replace($global[&#39;systemRootPath&#39;], &#39;&#39;, $paths[&#39;path&#39;]); $obj-&gt;fileThumbs = str_replace($global[&#39;systemRootPath&#39;], &#39;&#39;, $paths[&#39;path_thumbs&#39;]); ```</p> <p>`getPosterPaths()` is a static method th…</p> <p><strong>Affected:</strong> Packagist: wwbn/avideo</p> <p>## Summary</p> <p>The `plugin/Live/uploadPoster.php` endpoint allows any authenticated user to overwrite the poster image for any scheduled live stream by supplying an arbitrary `live_schedule_id`. The endpoint only checks `User::isLogged()` but never verifies that the authenticated user owns the targeted schedule. After overwriting the poster, the endpoint broadcasts a `socketLiveOFFCallback` notification containing the victim&#39;s broadcast key and user ID to all connected WebSocket clients.</p> <p>## Details</p> <p>The vulnerable endpoint at `plugin/Live/uploadPoster.php` accepts a `live_schedule_id` from `$_REQUEST` and uses it to determine poster file paths and trigger socket notifications without ownership validation.</p> <p>**Entry point — attacker-controlled input (line 11-12):** ```php $live_servers_id = intval($_REQUEST[&#39;live_servers_id&#39;]); $live_schedule_id = intval($_REQUEST[&#39;live_schedule_id&#39;]); ```</p> <p>**Insufficient auth check (line 14-17):** ```php if (!User::isLogged()) { $obj-&gt;msg = &#39;You cant edit this file&#39;; die(json_encode($obj)); } ```</p> <p>This only verifies the user is logged in. There is no check that `User::getId()` matches the schedule owner&#39;s `users_id`.</p> <p>**Poster path resolved by ID alone (line 40-42):** ```php $paths = Live_schedule::getPosterPaths($live_schedule_id, 0); $obj-&gt;file = str_replace($global[&#39;systemRootPath&#39;], &#39;&#39;, $paths[&#39;path&#39;]); $obj-&gt;fileThumbs = str_replace($global[&#39;systemRootPath&#39;], &#39;&#39;, $paths[&#39;path_thumbs&#39;]); ```</p> <p>`getPosterPaths()` is a static method th…</p> https://cve.radiocsirt.org/vuln/ghsa-g3hj-mf85-679g