VulnSocial

CVE-2026-64625Disclosure

LOWCVSS 9.3 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync() re-wraps escaped commands in double-quoted sh -c, allowing command substitution via $() and backticks. Attackers can inject arbitrary OS commands through the Live plugin on_publish.php endpoint despite escapeshellarg() protection.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 3 mentions (2026-07-21); latest day: 1
  • 4 total mentions across 2 days

Deep dive

Activity timeline4 mentions / 2d
01223Mentions · 2026-07-21: 3Mentions · 2026-07-31: 1Patch / Workaround · 2026-07-21: 1Patch / Workaround · 2026-07-31: 1Technical Details · 2026-07-21: 2Technical Details · 2026-07-31: 107-2107-31
Signal classification2 categories
Disclosure
250.0%
Patch
250.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-07-213
Disclosure2Patch1
2026-07-311
Patch1
Full discourse4 posts
  • Orizon@OrizonCyber
    Patch

    🚨 CVE-2026-64625 — CVSS 9.8/10 ██████████ AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync() re-wraps escaped commands in... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/taB2qgKGHV

    Post summary

    The tweet alerts about a critical CVE‑2026‑64625, mentions it has a CVSS score of 9.8/10, and states that a patch is now available, but provides no technical or exploitation details.

    1000028
    69 followersView on X
  • DFIR Lab@DFIR_Lab
    Patch

    🚨 CRITICAL: CVE-2026-64625 (CVSS 9.8) AVideo <29.0 incomplete patch for CVE-2026-45578. Attackers can inject OS commands via Live plugin despite escapeshellarg() protection. Patch immediately to v29.0+ #CVE #Vulnerability #PatchNow https://t.co/T47uXlXdSR

    Post summary

    The tweet alerts to critical CVE-2026-64625 (and CVE‑2026‑45578 with incomplete patch) that allows OS command injection, urging immediate patching to v29.0+; it provides technical details but no exploit or active use information.

    0000044
    99 followersView on X
  • takenaka hiroya@Joe_Biden_ja
    Disclosure

    「脆弱性対応ウォッチ」にてCriticalな脆弱性「CVE-2026-64625」を公開しました。AVideo 29.0未満のバージョンで確認されているコマンド注入に関する情報です。セキュリティ対策を検討されている方は、ぜひご一読いただき、ご自身の環境の安全確保にお役立てくださ… https://cve.autoarticles.net/cve/CVE-2026-64625

    Post summary

    The post announces CVE-2026-64625, a command‑injection flaw in AVideo versions below 29.0, and directs readers to a dedicated CVE page.

    0000046
    561 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-64625 Command Injection in AVideo Before 29.0 Live Plugin on_publish.php Endpoint https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-64625

    Post summary

    The text announces a command injection vulnerability (CVE‑2026‑64625) affecting the AVideo Live Plugin on the on_publish.php endpoint before version 29.0, but it does not include a PoC, exploit, patch, or evidence of active exploitation.

    0000079
    4.1K followersView on X

Explore more

Back to dashboard