Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
WWBN AVideo is an open source video platform. In 29.0 and earlier, there is a classic shell-metacharacter injection. The YPTSocket notification branch in plugin/Live/on_publish.php builds an execAsync() command line by string concatenation, single-quoting each argument but never calling escapeshellarg(). A ' in any of the three interpolated values ($users_id, $m3u8, $obj->liveTransmitionHistory_id) closes the quoted token and lets the attacker append arbitrary commands.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🚨 CVE-2026-64625 — CVSS 9.8/10 ██████████ AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync() re-wraps escaped commands in... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/taB2qgKGHV
Post summary
The tweet announces a critical vulnerability CVE‑2026‑64625 in AVideo, highlights an incomplete fix for CVE‑2026‑45578, and states that a patch is now available.
🚨 CRITICAL: CVE-2026-64625 (CVSS 9.8) AVideo <29.0 incomplete patch for CVE-2026-45578. Attackers can inject OS commands via Live plugin despite escapeshellarg() protection. Patch immediately to v29.0+ #CVE #Vulnerability #PatchNow https://t.co/T47uXlXdSR
Post summary
The tweet alerts to CVE‑2026‑64625 with high CVSS, notes OS command injection via Live plugin, and urges users to patch to v29.0+.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | wwbn | avideo | - | - | - |