PT-2026-27167 · Unknown+1 · Url2Embed.Json.Php+1

Ahmad-Jarwan · Publicado 2026-03-20 · Atualizado 2026-03-23 · CVE-2026-33512

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 26.1

Description AVideo is an open source video platform. Versions up to and including 26.0 have an API plugin that exposes a decryptString action without authentication. This allows anyone to submit ciphertext and receive plaintext. The ciphertext is publicly available, for example, through the /view/url2Embed.json.php endpoint, enabling unauthorized recovery of protected tokens and metadata.

Recommendations Update to version 26.1 or later.

Exploit

Correção

Improper Authentication

Inadequate Encryption Strength

Cleartext Storage of Sensitive Information

Use of a Broken Cryptographic Algorithm

Enumeração de Fraquezas

CWE-287

CWE-326

CWE-312

CWE-327

Identificadores relacionados

CVE-2026-33512

GHSA-MWJC-5J4X-R686

Produtos afetados

Avideo

Url2Embed.Json.Php

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33512.json · Exploit
• https://github.com/WWBN/AVideo · Nota
• https://github.com/WWBN/AVideo/commit/3fdeecef37bb88967a02ccc9b9acc8da95de1c13 · Correção
• https://github.com/WWBN/AVideo/security/advisories/GHSA-mwjc-5j4x-r686 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-mwjc-5j4x-r686 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-33512 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-33512 · Nota de Segurança