exploit/multi/http/avideo_notify_ffmpeg_unauth_rce

weaponized

AVideo notify.ffmpeg.json.php Unauthenticated RCE via Salt Discovery

view exploit source metasploittype exploitpublished 2025-12-19catalog metasploit

exploited CVEs (3)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2025-34433US	—	1.48% (74th)	Exploit	2025-12-19
AVideo versions 14.3.1 prior to 20.1 contain an unauthenticated remote code execution vulnerability caused by predictable generation of an installation salt using PHP uniqid(). The…
CVE-2025-34442US	high7.5	0.85% (58th)	Exploit	2025-12-17
AVideo versions prior to 20.1 disclose absolute filesystem paths via multiple public API endpoints. Returned metadata includes full server paths to media files, revealing underlyin…
CVE-2025-34441US	high7.5	0.85% (58th)	Exploit	2025-12-17
AVideo versions prior to 20.1 expose sensitive user information through an unauthenticated public API endpoint. Responses include emails, usernames, administrative status, and last…

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.