Unauthenticated Remote Code Execution in AVideo by WWBN

CVE-2025-34433

What is CVE-2025-34433?

AVideo versions 14.3.1 and earlier than 20.1 are susceptible to an unauthenticated remote code execution issue. This vulnerability arises from a predictable installation salt generation, facilitated by the PHP uniqid() function. Attackers can exploit this flaw due to the exposure of the installation timestamp through a public endpoint. By leveraging unauthenticated API responses that include a hash identifier, a malicious actor can brute-force the salt's remaining entropy. Upon recovering the salt, the attacker can encrypt a harmful payload and send it to a notification API endpoint that processes attacker-controlled input, leading to the execution of arbitrary code on the server under the web server user’s privileges.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References