Arkmarta

An issue exists where the `view/queue.php` endpoint uses the `pathinfo` function on the caller-controlled `fileURI` variable and stores the resulting filename via `setTitle` in `encoder queue.title` without proper neutralization. Because `fileURI` is not included in the `objects/security.php` filter lists, and the `Login::canUpload()` capability can be self-granted via an attacker-controlled login site, an attacker can submit a queue entry with a malicious HTML title. This title is subsequently loaded by `view/index.php` from `view/queue.json.php` into a jQuery Bootgrid table, where the title formatter concatenates `row.title` into raw cell HTML. This allows the execution of an event handler in the browser of a privileged viewer, such as an administrator or an operator on the attacker's streamer. The resulting script can access session-visible data and rendered streamer credentials, acting with the privileges of the viewer.

An unauthenticated remote attacker can read internal HTTP and HTTPS responses, including cloud instance-metadata credentials, and reach internal TCP services. The issue exists because the `url get contents` function in `objects/functions.php` accepts caller-controlled destinations after only syntax validation, failing to reject private, loopback, or link-local addresses and disabling TLS peer verification. The unauthenticated 'objects/login.json.php' endpoint returns a session object containing the raw fetched body, enabling full-response exfiltration via a supplied `siteURL`. Additionally, a pre-authentication variant in 'view/youtubeDl.json.php' routes an ftp `videoURL` into `FTPDownloader`, where the `parseFtpUrl` function in `objects/FTPDownloader.php` accepts the host and port for `ftp connect`, allowing requests to internal FTP services. Untrusted self-signed HTTPS certificates are also accepted.

The anonymous login interface reflects request values into HTML and JavaScript without proper output encoding. In `view/index.php`, the `webSiteRootURL` variable is returned verbatim by the `Streamer::getStreamerURL()` function in `objects/Streamer.php`, affecting navigation and form attributes, and is inserted into a single-quoted JavaScript string in `view/index.header.php`. The `user` and `pass` fields are only filtered for single quotes, allowing double quotes and angle brackets to break HTML attributes. Additionally, `view/index.header.php` reflects POST fields using `json encode` without `JSON HEX TAG`, enabling a closing script tag to break out. Furthermore, `locale/function.php` stores the POST `lang` value in the session, which is then reflected unescaped in `view/index.php`. An unauthenticated remote attacker can use a crafted login link to execute arbitrary JavaScript, potentially stealing operator session identifiers and login credentials to perform unauthorized actions.

An unauthenticated installer endpoint `install/checkConfiguration.php` fails to escape request parameters, such as `webSiteRootURL`, when interpolating them into single-quoted PHP string literals to create the `videos/configuration.php` file. This allows an attacker to inject PHP code that executes as the web-server user when the generated file is accessed. This is possible if `videos/configuration.php` is absent, which occurs during fresh deployments or after the file is removed. The attacker can control the `systemRootPath` to write files, read or overwrite files owned by the web-server user, and establish persistent PHP code. Additionally, the endpoint interpolates request values into streamer and configuration INSERT statements, resulting in a secondary SQL injection sink.

An unauthenticated remote attacker can achieve operating-system command execution as the web-server user. The issue exists in the live-streaming endpoint `view/videosListToLive.php`, which accepts an attacker-defined streamer in the `webSiteRootURL` parameter. The system calls the `Login::run()` function in `objects/Login.php` and trusts the returned JSON as session state, allowing an attacker to self-grant `isLogged` and `canStream` privileges without valid credentials. This process bypasses the `Streamer::isURLAllowed()` check and the operator's streamer allowlist. Furthermore, the endpoint accepts `playlists id` and `APISecret` values, where the `APISecret` is forwarded without being verified against a stored secret. The application then fetches a second attacker-controlled video-list response and interpolates `videos[].path` into `ffprobe` and `ffmpeg` commands passed to `exec` without proper shell argument escaping. The `isAudio()` function calls `isVideo()` to trigger the `ffprobe` command. By using shell delimiters in the paths, an attacker can execute arbitrary commands, potentially disclosing database and streamer credentials, modifying files, establishing persistence, or causing a denial of service for the encoder.

An unauthenticated streamer login process allows for SQL injection. The endpoint `objects/login.json.php` passes the `user` parameter to the `Streamer::get()` function in `objects/Streamer.php`, which is then interpolated into a MariaDB SELECT query without proper parameterization or escaping. While literal single quotes are stripped, the `html entity decode` function in `objects/Login.php` restores entity-encoded quotes before the query is executed. An attacker can use this to read arbitrary encoder database data, such as stored upstream streamer credentials, allowlist configurations, and queue records. The impact is limited to data reads because stacked statements are not permitted by the mysqli driver and the database account lacks global FILE privileges.

The encoder lacks a global authentication layer, exposing several PHP endpoints to anonymous network callers. The endpoint 'view/run.php' invokes the `Encoder::run()` function. The endpoint 'view/queue.json.php' calls `Encoder::getAll(true)`, reveals streamer URLs via `getSiteURL()`, and triggers processing through `execRun()`. The endpoint 'view/status.php' returns a wildcard Access-Control-Allow-Origin header, reads the queue, triggers processing, and exposes host memory statistics through `ServerMonitor::getMemory()` when `serverStatus` is enabled. Additionally, the endpoint 'view/listFiles.json.php' allows anonymous access when `disableBulkEncode` is empty, using the `path` parameter with `realpath()` and `scandir()` without base-directory restrictions. This allows an unauthenticated attacker to control the privileged queue processor, access queue and streamer-site information, obtain memory statistics, and enumerate media file names and paths in directories readable by the web-server user, limited to configured media extensions.

The @nx/docker release pipeline constructs docker tag, image lookup, and docker push invocations as shell command strings. The configuration values `release.docker.repositoryName` and `registryUrl` are interpolated into these strings and passed to /bin/sh -c. This allows shell syntax within untrusted Nx configurations to execute during nx release version or nx release publish operations. Consequently, a pull request or repository configuration change could execute commands with the privileges of the release job, potentially exposing registry credentials or cloud tokens. Dry-run publishing does not prevent the execution of the vulnerable pre-check command.

Nx migration planning fails to validate that the `nx-migrations.migrations` value read from a target package manifest is a contained relative path. A hostile direct dependency or a package introduced via a trusted package's `packageGroup` can provide absolute paths or `..` segments. This allows the `nx migrate` process to write attacker-controlled bytes outside the intended temporary directory or truncate existing writable files. This issue occurs during migration planning before the migration list is reviewed or the `--run-migrations` flag is used. The vulnerability is triggered when the standard `nx@latest` handoff is bypassed using `NX USE LOCAL`, `NX MIGRATE USE LOCAL`, `NX MIGRATE CLI VERSION`, `--run-id`, or following a temporary-install failure.

In the Upload plugin, Content API endpoints failed to enforce administrator-configured MIME type restrictions defined in `plugin.upload.security.allowedTypes` and `deniedTypes`. While these restrictions were active for the Admin Panel, the `enforceUploadSecurity` security check was missing from the Content API controller. Consequently, the `uploadFiles` and `replaceFile` handlers, as well as the `upload` wrapper, bypassed MIME detection and allow/deny lists. An authenticated user with Content API upload permissions could upload disallowed file types, such as HTML and SVG. If uploaded files are served from the same origin as the admin panel, an attacker could upload a malicious HTML or SVG file. When opened by an administrator, this file could execute JavaScript within the admin origin, potentially leading to admin-session hijacking and unauthorized administrative actions via the admin API.

Name of the Vulnerable Software and Affected Versions Payload versions prior to 3.79.1 Description Payload, a headless content management system, had insufficient input validation in certain requests. This allowed attackers to manipulate SQL query execution, potentially leading to data exposure or modification in collections. Recommendations Upgrade to version 3.79.1 or later.

AVideo is a video-sharing platform. Versions prior to 8.0 contain a SQL Injection issue in the `getSqlFromPost()` method of Object.php. The `$ POST['sort']` array keys are used directly as SQL column identifiers within an ORDER BY clause. While `real escape string()` was applied, it only escapes string-context characters and does not protect SQL identifiers, rendering it ineffective. The issue stems from the direct use of unsanitized input in constructing a SQL query. The `sort` parameter within the `$ POST` request is particularly vulnerable.

AVideo is a video-sharing Platform software susceptible to unauthenticated Remote Code Execution (RCE). An attacker can inject shell command substitution into the `base64Url` GET parameter, potentially leading to full server compromise, data exfiltration, and service disruption. The issue resides in the improper handling of user-supplied input within shell commands, specifically in files `objects/getImage.php` and `objects/security.php`, utilizing functions like `shell exec` and `nohup`. The root cause is the lack of proper shell escaping when decoding and interpolating the `base64Url` parameter into shell commands. The `FILTER VALIDATE URL` validation does not prevent shell metacharacters from being interpreted by the shell.

AVideo is an open source video platform. A Remote Code Execution (RCE) issue was identified in the plugin upload/import functionality. An authenticated administrator could upload a specially crafted ZIP archive containing executable server-side files. Insufficient validation of extracted file contents allowed the archive to be extracted directly into a web-accessible plugin directory, enabling arbitrary PHP code execution. The issue allows for full system compromise, including confidentiality, integrity, and availability impact. The system validated only the ZIP extension of uploaded plugin packages but did not enforce a strict allowlist of file types within the archive. Extracted files were placed directly in a web-accessible directory without preventing execution of server-side scripts.

The Canarytokens PWA Canarytoken has a Self Cross-Site Scripting issue. A Canarytoken creator can execute Javascript code by inserting it into the title field of their PWA token. This allows the creator to attack themselves or anyone they share the link with. When a victim clicks on the installation link, the Javascript code executes. However, no sensitive information is disclosed to a malicious actor.

AVideo is an open source video platform. The `aVideoEncoder.json.php` API endpoint accepts a `downloadURL` parameter and fetches the referenced resource server-side without proper validation or an allow-list. This allows authenticated users to trigger server-side requests to arbitrary URLs, including internal network endpoints, leading to Server-Side Request Forgery (SSRF). An authenticated attacker can leverage SSRF to interact with internal services and retrieve sensitive data, potentially leading to further compromise. The vulnerable parameter is `downloadURL`.

AVideo allows Markdown in video comments and uses Parsedown (v1.7.4) without Safe Mode enabled. Markdown links are not sufficiently sanitized, allowing `javascript:` URIs to be rendered as clickable links. An authenticated low-privilege attacker can post a malicious comment that injects persistent JavaScript. When another user clicks the link, the attacker can perform actions such as session hijacking, privilege escalation (including admin takeover), and data exfiltration. The issue is a Stored Cross-Site Scripting (XSS) as defined by CWE-79.

CVAT is an interactive video and image annotation tool for computer vision. An attacker can execute arbitrary JavaScript in a victim user's CVAT UI session. This is possible by creating a maliciously crafted label in a CVAT task or project, and then getting the victim user to either edit that label or view a shape referencing that label. Alternatively, the attacker can get the victim user to upload a maliciously crafted SVG image when configuring a skeleton. Successful exploitation grants the attacker temporary access to all CVAT resources accessible to the victim user.

CVAT is an open source interactive video and image annotation tool for computer vision. Users with staff status can modify their permissions, including granting themselves superuser status and joining the admin group, which provides full access to the data within the CVAT instance.