CVE-2023-25313

CRITICAL

AVideo contains Command injection when embedding a video link

Published February 2, 2023Updated July 8, 2026Source: osv

Summary

Impact: An attacker could execute remote code on a system running wwbn/avideo Step to Reproduce: 1. Go to the `My Videos` tab https://demo.avideo.com/mvideos 2. Click "Embed a video link" Append a command to the url as a query string. eg. `?whoami` then click Save This issue has been resolved in commit `236228f15`

Remediation

Upgrade to the fixed version using your package manager.

Composer

Update wwbn/avideo to 12.4 or later

composer require "wwbn/avideo:^12.4"

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Package	Ecosystem	Affected	Fixed In
wwbn/avideo	packagist	10.4, 10.8, 11, 11.1 (+3 more)	12.4

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-79
Cross-site Scripting (XSS)MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.6 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2023-25313?: AVideo contains Command injection when embedding a video link This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.6/10).
How do I check if my project is affected by CVE-2023-25313?: CVE-2023-25313 affects wwbn/avideo. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2023-25313 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.6

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-pgvh-p3g4-86jw

Related CVEs

CVE-2026-33502
CRITICAL
AVideo has Unauthenticated SSRF via plugin/Live/test.php
CVE-2026-33351
CRITICAL
AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass
CVE-2026-49279
HIGH
WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass)
CVE-2026-33648
HIGH
AVideo Vulnerable to OS Command Injection via Unsanitized `users_id` and `liveTransmitionHistory_id` in Restreamer Log File Path
CVE-2026-33647
HIGH
AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload
CVE-2026-33479
HIGH
AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin
CVE-2026-41304
HIGH
WWBN AVideo: RCE cause by clonesite plugin
CVE-2026-45578
HIGH
AVideo: OS command injection in on_publish.php execAsync via unescaped m3u8 URL

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies