https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 21 Oct 2026 00:36:09 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-318031 EUVD-2026-318031 https://cve.radiocsirt.org/vuln/euvd-2026-318031 https://cve.radiocsirt.org/vuln/fkie_cve-2026-43876 <p>WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/notifySubscribers.json.php takes the raw message POST parameter and passes it into sendSiteEmail(), which substitutes it directly into an HTML email template (via str_replace on the {message} placeholder) and renders it with PHPMailer::msgHTML(). There is no HTML sanitization, character escaping, or output encoding on the attacker-controlled message between $_POST[&#39;message&#39;] and the rendered email. Any authenticated user with upload permission can therefore broadcast arbitrary HTML — phishing links, tracking pixels, CSS/UI spoofing — to every subscriber on their channel (up to 10,000 recipients per invocation). The email is sent From: the platform&#39;s configured contact address and wrapped in the site&#39;s official logo and title, so attacker-supplied HTML arrives with the appearance of an official platform communication. Commit https://github.com/WWBN/AVideo/commit/ contains an updated fix.</p> <p>WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/notifySubscribers.json.php takes the raw message POST parameter and passes it into sendSiteEmail(), which substitutes it directly into an HTML email template (via str_replace on the {message} placeholder) and renders it with PHPMailer::msgHTML(). There is no HTML sanitization, character escaping, or output encoding on the attacker-controlled message between $_POST[&#39;message&#39;] and the rendered email. Any authenticated user with upload permission can therefore broadcast arbitrary HTML — phishing links, tracking pixels, CSS/UI spoofing — to every subscriber on their channel (up to 10,000 recipients per invocation). The email is sent From: the platform&#39;s configured contact address and wrapped in the site&#39;s official logo and title, so attacker-supplied HTML arrives with the appearance of an official platform communication. Commit https://github.com/WWBN/AVideo/commit/ contains an updated fix.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-43876 https://cve.radiocsirt.org/vuln/ghsa-g9cm-rxp7-6gv5 <p><strong>Affected:</strong> Packagist: wwbn/avideo</p> <p>## Summary</p> <p>`objects/notifySubscribers.json.php` takes the raw `message` POST parameter and passes it into `sendSiteEmail()`, which substitutes it directly into an HTML email template (via `str_replace` on the `{message}` placeholder) and renders it with `PHPMailer::msgHTML()`. There is no HTML sanitization, character escaping, or output encoding on the attacker-controlled `message` between `$_POST[&#39;message&#39;]` and the rendered email. Any authenticated user with upload permission can therefore broadcast arbitrary HTML — phishing links, tracking pixels, CSS/UI spoofing — to every subscriber on their channel (up to 10,000 recipients per invocation). The email is sent From: the platform&#39;s configured contact address and wrapped in the site&#39;s official logo and title, so attacker-supplied HTML arrives with the appearance of an official platform communication.</p> <p>## Details</p> <p>**File:** `objects/notifySubscribers.json.php`</p> <p>```php 10: if (!User::canUpload()) { 11: forbiddenPage(&#39;You can not notify&#39;); 12: } 13: forbidIfIsUntrustedRequest(&#39;notifySubscribers&#39;); 14: $user_id = User::getId(); 15: // if admin bring all subscribers 16: if (User::isAdmin()) { 17: $user_id = &#39;&#39;; 18: } 19: 20: require_once &#39;subscribe.php&#39;; 21: setRowCount(10000); ... 23: $Subscribes = Subscribe::getAllSubscribes($user_id); ... 34: $subject = &#39;Message From Site &#39; . $config-&gt;getWebSiteTitle(); 35: $message = $_POST[&#39;message&#39;]; 36: 37: $resp = sendSiteEmail($to, $subject, $message); ```</p> <p>Controls present at…</p> <p><strong>Affected:</strong> Packagist: wwbn/avideo</p> <p>## Summary</p> <p>`objects/notifySubscribers.json.php` takes the raw `message` POST parameter and passes it into `sendSiteEmail()`, which substitutes it directly into an HTML email template (via `str_replace` on the `{message}` placeholder) and renders it with `PHPMailer::msgHTML()`. There is no HTML sanitization, character escaping, or output encoding on the attacker-controlled `message` between `$_POST[&#39;message&#39;]` and the rendered email. Any authenticated user with upload permission can therefore broadcast arbitrary HTML — phishing links, tracking pixels, CSS/UI spoofing — to every subscriber on their channel (up to 10,000 recipients per invocation). The email is sent From: the platform&#39;s configured contact address and wrapped in the site&#39;s official logo and title, so attacker-supplied HTML arrives with the appearance of an official platform communication.</p> <p>## Details</p> <p>**File:** `objects/notifySubscribers.json.php`</p> <p>```php 10: if (!User::canUpload()) { 11: forbiddenPage(&#39;You can not notify&#39;); 12: } 13: forbidIfIsUntrustedRequest(&#39;notifySubscribers&#39;); 14: $user_id = User::getId(); 15: // if admin bring all subscribers 16: if (User::isAdmin()) { 17: $user_id = &#39;&#39;; 18: } 19: 20: require_once &#39;subscribe.php&#39;; 21: setRowCount(10000); ... 23: $Subscribes = Subscribe::getAllSubscribes($user_id); ... 34: $subject = &#39;Message From Site &#39; . $config-&gt;getWebSiteTitle(); 35: $message = $_POST[&#39;message&#39;]; 36: 37: $resp = sendSiteEmail($to, $subject, $message); ```</p> <p>Controls present at…</p> https://cve.radiocsirt.org/vuln/ghsa-g9cm-rxp7-6gv5