CVE-2025-34440: medium-severity vulnerability in World Wide Broadcast Network AVideo
AVideo < 20.1 Open Redirect via siteRedirectUri Parameter
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.8epss 0.2%
AVideo versions prior to 20.1 contain an open redirect vulnerability caused by insufficient validation of the siteRedirectUri parameter during user registration. Attackers can redirect users to external sites, facilitating phishing attacks.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Affected products
World Wide Broadcast Network · AVideoRelated CVEs — World Wide Broadcast Network AVideo
In the same product, most dangerous first.
CVE-2025-34433CRITICALAVideo < 20.1 Unauthenticated RCE via Predictable Installation SaltEPSS 1.5%CVE-2025-34442MEDIUMAVideo < 20.1 System Path Disclosure via Public APIEPSS 0.9%CVE-2025-34441MEDIUMAVideo < 20.1 User Information Disclosure via Public APIEPSS 0.9%CVE-2025-34434CRITICALAVideo < 20.1 ImageGallery Plugin Unauthenticated File Upload and DeletionEPSS 0.5%CVE-2025-34436HIGHAVideo < 20.1 IDOR Arbitrary File UploadEPSS 0.4%CVE-2025-34437HIGHAVideo < 20.1 IDOR Arbitrary Comment Image UploadEPSS 0.4%