AVideo is a video-sharing Platform. Prior to 8.1.0, view/queue.php uses pathinfo on the caller-controlled fileURI and stores its filename through setTitle in encoderqueue.title without neutralization. fileURI is not in the objects/security.php filter lists, and the Login::canUpload() capability needed to submit a queue entry can be self-granted using an attacker-controlled login site without legitimate encoder credentials. view/index.php loads queue.json from view/queue.json.php into the #grid jQuery Bootgrid table; its title formatter concatenates row.title into raw cell HTML. An attacker can therefore store an HTML title whose event handler runs in a privileged viewer's browser. Encoder::getAll limits nonadministrators to their own streamer's rows, so the victim must be an administrator who sees all rows or an operator on the attacker's streamer. A second .html() sink in the progress panel uses the same title but additionally depends on a helper script loaded from the streamer; the Bootgrid sink is reachable from encoder code alone. The script can read session-visible data and rendered streamer credentials, act with the viewer's privileges, and execute again for each qualifying viewer until the row is removed. This issue is fixed in version 8.1.0.

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated streamer login at objects/login.json.php passes the user parameter to Streamer::get in objects/Streamer.php, where it is interpolated into a single-quoted MariaDB SELECT without parameterization or escaping. Although objects/security.php strips literal single quotes, htmlentitydecode in objects/Login.php restores entity-encoded quotes before the query. The supplied siteURL must pass the streamer allowlist, which allows all sites when empty by default, and an attacker-hosted login response must set canUpload or isAdmin to reach Streamer::createIfNotExists. That function calls Streamer::get before its additional allowlist check. UNION results are exposed through streamersid, while failures return the rendered query and MariaDB error. An attacker can read arbitrary encoder database data, including stored upstream streamer credentials, allowlist configuration, and queue records, without encoder credentials. Stacked statements are not permitted by the mysqli driver and the tested database account lacks global FILE privilege, so the demonstrated vector is bounded to reads rather than server-side file writes. Stolen streamer credentials can provide continued upstream access until rotated. This issue is fixed in version 8.1.0.

AVideo is a video-sharing Platform. Prior to 8.1.0, the encoder lacks a global authentication layer and exposes control and status PHP endpoints to anonymous network callers. view/run.php has a commented-out guard and invokes Encoder::run(). view/queue.json.php calls Encoder::getAll(true), reveals streamer URLs through getSiteURL(), and triggers processing with execRun(). view/status.php returns Access-Control-Allow-Origin with a wildcard, reads the queue, triggers processing, and exposes host memory statistics through ServerMonitor::getMemory() when serverStatus is set. view/listFiles.json.php checks only Login::canBulkEncode(), which admits anonymous callers whenever disableBulkEncode is empty, the default. Its path parameter is resolved with realpath() and listed with scandir() without a base-directory restriction. An unauthenticated attacker can drive the privileged queue processor, read queue and streamer-site information, obtain memory statistics and enumerate media file names and paths in any directory readable by the web-server user. Enumeration is limited to configured media extensions and does not itself disclose arbitrary file contents. This issue is fixed in version 8.1.0.

AVideo is a video-sharing Platform. Before the initial remediation attempt in 8.1.0, urlgetcontents in objects/functions.php accepts caller-controlled destinations after only FILTERVALIDATEURL syntax validation, without rejecting private, loopback, or link-local addresses, and disables TLS peer verification. Login::isLogged reauthenticates using the attacker-settable encoderaVideoURL cookie together with arbitrary nonempty encoderuser and encoderpass cookies, and Login::run stores the raw fetched body in result. The unauthenticated objects/login.json.php endpoint returns that session object, enabling full-response exfiltration through a supplied siteURL; its Streamer::isURLAllowed gate allows all sites when the operator allowlist is empty, the default. An unauthenticated remote attacker can read internal HTTP and HTTPS responses, including cloud instance-metadata credentials, and reach internal TCP services. A further pre-authentication FTP variant in view/youtubeDl.json.php routes an ftp videoURL into FTPDownloader; parseFtpUrl in objects/FTPDownloader.php accepts its host and port for ftpconnect. This also enables requests to internal FTP services. Untrusted self-signed HTTPS certificates are accepted, and no account or operator interaction is required. Version 8.1.0 contains an initial remediation attempt that removes raw-response reflection and adds destination checks, but private-network exemptions and login TLS-verification defaults leave complete remediation of the described internal-network and TLS variants unresolved.

AVideo is a video-sharing Platform. Prior to 8.1.0, the anonymous login interface reflects request values into HTML and JavaScript without output encoding. In view/index.php, webSiteRootURL is returned verbatim by Streamer::getStreamerURL() in objects/Streamer.php and reaches navigation and form attributes; it also enters a single-quoted JavaScript string in view/index.header.php. It is not filtered by objects/security.php, while the user and pass fields are filtered only for single quotes, leaving double quotes and angle brackets capable of breaking out of their HTML attributes. In addition, view/index.header.php reflects POST fields using jsonencode without JSONHEXTAG, allowing a closing script tag to break out, and locale/function.php stores the POST lang value in the session for unescaped reflection in view/index.php. An unauthenticated remote attacker who persuades a victim to open a crafted login link can execute arbitrary JavaScript in the encoder's origin. This can read the operator session identifier exposed in inline script, capture login credentials and perform actions as the operator against the encoder and its upstream platform. This issue is fixed in version 8.1.0.

AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint view/videosListToLive.php accepts an attacker-named streamer in webSiteRootURL, calls Login::run in objects/Login.php, and trusts the returned JSON as session state. An unauthenticated remote attacker who can host an HTTP service reachable by the encoder can self-grant isLogged and canStream without legitimate credentials. The endpoint requires only nonempty playlistsid and APISecret values; APISecret is forwarded rather than checked against a stored secret. This path never calls Streamer::isURLAllowed and therefore works regardless of the operator's streamer allowlist. It fetches a second attacker-controlled video-list response and interpolates videos[].path without shell argument escaping into ffprobe and ffmpeg commands passed to exec; isAudio calls isVideo to reach the ffprobe command. Paths containing shell delimiters execute arbitrary operating-system commands as the web-server user. The request filter does not inspect the video-list JSON. This can disclose database and stored streamer credentials, compromise the upstream platform using those credentials, modify files owned by the web-server user, establish persistence, and deny encoder service. This issue is fixed in version 8.1.0.

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint install/checkConfiguration.php assembles videos/configuration.php by interpolating request parameters, including webSiteRootURL, into single-quoted PHP string literals without escaping. An attacker can terminate a literal and inject PHP that executes as the web-server user when the generated, directly requestable file is loaded. Exploitation requires videos/configuration.php to be absent, as on every fresh deployment or after the file is removed or moved; an existing file blocks this endpoint. The supplied systemRootPath must contain index.php and a connection using databaseHost, databaseUser, and databasePass must succeed, but the attacker can point those parameters to their own database server and needs no target credentials. The write location is also derived from systemRootPath without a base-directory constraint. This permits arbitrary command execution, reading and overwriting files owned by the web-server user, persistent PHP code, and control over stored database connection settings. The endpoint additionally interpolates request values into streamer and configuration INSERT statements, creating a secondary SQL-injection sink. This issue is fixed in version 8.1.0.

AVideo is a video-sharing Platform. Versions prior to 8.0 contain a SQL Injection vulnerability in the getSqlFromPost() method of Object.php. The $POST['sort'] array keys are used directly as SQL column identifiers inside an ORDER BY clause. Although realescapestring() was applied, it only escapes string-context characters (quotes, null bytes) and provides no protection for SQL identifiers — making it entirely ineffective here. This issue has been fixed in version 8.0. To workaround this issue without upgrading, operators can apply a WAF rule to block POST requests where any sort[] key contains characters outside [A-Za-z0-9]. Alternatively, restrict access to the queue view (queue.json.php, index.php) to trusted IP ranges only.

AVideo is a video-sharing Platform. Versions prior to 8.0 contain a Server-Side Request Forgery vulnerability (CWE-918) in the public thumbnail endpoints getImage.php and getImageMP4.php. Both endpoints accept a base64Url GET parameter, base64-decode it, and pass the resulting URL to ffmpeg as an input source without any authentication requirement. The prior validation only checked that the URL was syntactically valid (FILTERVALIDATEURL) and started with http(s)://. This is insufficient: an attacker can supply URLs such as http://169.254.169.254/latest/meta-data/ (AWS/cloud instance metadata), http://192.168.x.x/, or http://127.0.0.1/ to make the server reach internal network resources. The response is not directly returned (blind), but timing differences and error logs can be used to infer results. The issue has been fixed in version 8.0.