CVE-2024-31819: WWBN AVideo Remote Code Execution
An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath parameter of the submitIndex.php component.
Published Apr 10, 2024 · Updated Aug 29, 2024
Affected packages
wwbn/avideo
- Ecosystem
- Composer (PHP)
- Affected
- >= 12.4, <= 14.2
- Fixed in
- 14.3
- Check
composer show wwbn/avideo
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath parameter of the submitIndex.php component.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More Composer (PHP) vulnerabilities
All Composer (PHP) entriesCVE-2026-40911
WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks
critical10.0No fixApr 14, 2026CVE-2026-33867
AVideo has Plaintext Video Password Storage
critical9.1No fixMar 26, 2026CVE-2026-33716
AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php
critical9.4No fixMar 25, 2026CVE-2026-33478
AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection
critical10.0No fixMar 20, 2026CVE-2026-33502
AVideo has Unauthenticated SSRF via plugin/Live/test.php
critical9.3No fixMar 20, 2026CVE-2026-33351
AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass
critical9.1No fixMar 19, 2026