Wwbn Avideo敏感系统信息暴露给未经授权的控制领域漏洞(CVE-2025-34442)

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-34442
• https://github.com/advisories/GHSA-9jhw-7r2c-h2mf
• https://chocapikk.com/posts/2025/avideo-security-vulnerabilities/
• https://www.vulncheck.com/advisories/avideo-system-path-disclosure-via-public-api
• https://vuldb.com/vuln/337018
• https://cve.imfht.com/detail/CVE-2025-34442?lang=en
• https://github.com/WWBN/AVideo/commit/4a53ab2056
• https://github.com/WWBN/AVideo/commit/dbe3e91c54

Related Vulnerabilities

• AVideo /plugin/API/get.json.php 文件包含漏洞（CVE-2026-33513）
• WWBN AVideo /objects/plugins.json.php 信息泄露漏洞 （CVE-2026-43885）
• PoCCVE-2026-33478: AVideo <= 26.0 - WWBN AVideo - Remote Code Execution
• AVideo /plugin/Live/test.php 服务器端请求伪造漏洞（CVE-2026-33502）
• (CVE-2025-34433) AVideo 安装盐预测远程代码执行漏洞
• Wwbn Avideo任意重定向漏洞(CVE-2025-34440)
• Wwbn Avideo权限绕过漏洞(CVE-2025-34438)
• Wwbn Avideo任意重定向漏洞(CVE-2025-34439)
• Wwbn Avideo向未经授权的行为者暴露私人个人信息漏洞(CVE-2025-34441)
• Wwbn Avideo权限绕过漏洞(CVE-2025-34437)
• Wwbn Avideo权限绕过漏洞(CVE-2025-34436)
• Wwbn Avideo权限绕过漏洞(CVE-2025-34435)
• Wwbn Avideo缺少关键功能的身份验证漏洞(CVE-2025-34434)