AVideo CVE-2026-43884 incomplete fix - six (or more) `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD post-`603e7bf`

Mô tả

$resolvedIP = null;
if (isSSRFSafeURL($url, $resolvedIP)) {
    curl_setopt($ch, CURLOPT_RESOLVE, ["$h

Tham khảo

• WWBN/AVideo security advisory · WEB
• nvd.nist.gov/vuln/detail/CVE-2026-45619 · ADVISORY
• WWBN/AVideo · PACKAGE
• GitHub Advisory GHSA-2hch-c97c-g99x · ADVISORY

Lỗ hổng khác của WWBN/AVideo

• CVE-2026-54458NGHIÊM TRỌNG 9.6WWBN AVideo is an open source video platform. Versions prior to 29.0 contain a stored DOM Cross-Site Scripting vulnerability in the YPTSocke…
• CVE-2026-50183TRUNG BÌNH 4.7WWBN AVideo is an open source video platform. Versions 29.0 and below contain a stored Cross-Site Scripting vulnerability in the YouTubeAPI …
• CVE-2026-50182TRUNG BÌNH 6.1WWBN AVideo is an open source video platform. Versions prior to 29.0 contain an unauthenticated Reflected XSS vulnerability through AVideo Y…
• CVE-2026-56345CAO 8.1AVideo through 29.0 contains an authorization bypass vulnerability in the Meet plugin's uploadRecordedVideo.json.php endpoint that derives t…
• CVE-2026-47696TRUNG BÌNH 4.3WWBN AVideo is an open source video platform. In 29.0 and earlier, plugin/AuthorizeNet/processPayment.json.php credits the logged-in user's …