by Kastro
Paper/Archive/CVE-2025-34434

CVE-2025-34434

World Wide Broadcast Network AVideo — AVideo < 20.1 ImageGallery Plugin Unauthenticated File Upload and Deletion

EPSS 0.5%CVSS 9.3
critical.is priorityof 100
36
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 40.4.404 × 208.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

AVideo versions prior to 20.1 with the ImageGallery plugin enabled is vulnerable to unauthenticated file upload and deletion. Plugin endpoints responsible for managing gallery images fail to enforce authentication checks and do not validate ownership, allowing unauthenticated attackers to upload or delete images associated with any image-based video.

Affected

ProductAffectedFixed inSource
AVideo< 20.120.1CNA

Scores by source

VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

patchgithub.com/WWBN/AVideo/commit/4a53ab2056patchgithub.com/WWBN/AVideo/commit/c279999cbdwriteupvulncheck.com/advisories/avideo-imagegallery-plugin-unauthenticated-file-upload-and-deletionexploitchocapikk.com/posts/2025/avideo-security-vulnerabilities