Vulnerability Spotlight: Vulnerabilities in WWBN AVideo web app could lead to command injection, authentication bypass

Summary: Cisco Talos discovered multiple vulnerabilities in the WWBN AVideo open-source video streaming application, including command injection issues (TALOS-2022-1546/CVE-2022-30534 and TALOS-2022-1548/CVE-2022-32572), a directory traversal flaw during zip extraction (TALOS-2022-1547/CVE-2022-30547), information disclosure bugs, three privilege escalation issues, and a SQL injection vulnerability (TALOS-2022-1551/CVE-2022-33147-CVE-2022-33149). Talos confirmed WWBN AVideo version 11.6 and dev master commit 3f7c0364 are affected, worked with WWBN to coordinate disclosure and patch the issues, and released Snort rules including 59993-59998 and 60003-60006 to detect exploitation attempts.
What's compelling: An attacker who chains the SQL injection to extract an admin password hash with the TALOS-2022-1545 flaw that logs in using only a hashed password can take over an administrator account without ever cracking the hash.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2022-28710 CVE-2022-29468 CVE-2022-30534 CVE-2022-30547 CVE-2022-30605 CVE-2022-32282 CVE-2022-32572 CVE-2022-32761 CVE-2022-32777 CVE-2022-32778 CVE-2022-33147 CVE-2022-33149
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026