Vulnerability Spotlight: Multiple vulnerabilities in YouPHPTube

Summary: Cisco Talos disclosed multiple vulnerabilities in YouPHPTube, an open-source program for building custom video sites, including SQL injection flaws in the authenticated portion of version 7.6 and two unauthenticated command injection flaws in the YouPHPTube Encoder 2.3 plugin disclosed on Oct. 30, 2019. Talos said specially crafted web requests could let an attacker exfiltrate database files, steal user credentials and, in some configurations, access the underlying operating system, and that it worked with YouPHPTube to resolve the issues and make an update available.
Bottom line: The Encoder 2.3 flaws require no credentials at all, so anyone who can reach the server can send a request that may lead to database exfiltration, credential theft and compromise of the underlying operating system.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2019-5117 CVE-2019-5119 CVE-2019-5120 CVE-2019-5121 CVE-2019-5123
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026