PT-2026-25998 · Wwbn · Avideo

Offensiveee · Publicado 2026-03-17 · Atualizado 2026-03-20 · CVE-2026-33041

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions 25.0 and below

Description The /objects/encryptPass.json.php endpoint in WWBN AVideo exposes the application's password hashing algorithm to any unauthenticated user. An attacker can submit arbitrary passwords and receive their hashed equivalents, enabling offline password cracking against leaked database hashes. The encryptPassword() function uses a weak hash chain (md5+whirlpool+sha1, no salt by default), making password cracking extremely fast with access to database hashes. The vulnerable file is objects/encryptPass.json.php, and the vulnerable function is encryptPassword(). The encryptPassword() function is located in objects/functions.php around line 2101. The vulnerable parameter is pass in the API endpoint /objects/encryptPass.json.php.

Recommendations Versions 25.0 and below should be updated to version 26.0 or later.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2026-33041

GHSA-PX7X-GQ96-RMP5

Produtos afetados

Avideo

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33041.json · Exploit
• https://github.com/WWBN/AVideo · Nota
• https://github.com/WWBN/AVideo/commit/ea2efd04464560cca93c9ab48b445dbb944a4e46 · Correção
• https://github.com/WWBN/AVideo/security/advisories/GHSA-px7x-gq96-rmp5 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-px7x-gq96-rmp5 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2034891541945123127 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-33041 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-33041 · Nota de Segurança