CVE-2026-61569High· 7.5▾ MidnightPoC availableAVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated streamer login at `objects/login.json.php` passes the `user` parameter to `Streamer::get` in `objects/Streamer.php`, where it is interpolated into a single-quoted Ma…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.3%
AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated streamer login at objects/login.json.php passes the user parameter to Streamer::get in objects/Streamer.php, where it is interpolated into a single-quoted MariaDB SELECT without parameterization or escaping. Although objects/security.php strips literal single quotes, html_entity_decode in objects/Login.php restores entity-encoded quotes before the query. The supplied siteURL must pass the streamer allowlist, which allows all sites when empty by default, and an attacker-hosted login response must set canUpload or isAdmin to reach Streamer::createIfNotExists. That function calls Streamer::get before its additional allowlist check. UNION results are exposed through streamers_id, while failures return the rendered query and MariaDB error. An attacker can read arbitrary encoder database data, including stored upstream streamer credentials, allowlist configuration, and queue records, without encoder credentials. Stacked statements are not permitted by the mysqli driver and the tested database account lacks global FILE privilege, so the demonstrated vector is bounded to reads rather than server-side file writes. Stolen streamer credentials can provide continued upstream access until rotated. This issue is fixed in version 8.1.0.
AVideo-Encoder < 8.1.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-61572High· 8.6AVideo-Encoder: unauthenticated full-response server-side request forgery
CVE-2026-61573Medium· 6.1AVideo-Encoder: reflected cross-site scripting in the login interface
CVE-2026-61575Medium· 4.7AVideo-Encoder vulnerable to stored DOM cross-site scripting through queue titles
CVE-2026-61567Critical· 10.0AVideo-Encoder: unauthenticated command execution through streamer login trust
CVE-2026-61571High· 7.3AVideo-Encoder: missing authentication on control and status endpoints
CVE-2026-61564Critical· 10.0AVideo-Encoder: unauthenticated installer PHP code injection