{"metadata": {"vulnerability": "CVE-2026-61564", "count": 8, "kinds": {"milestone": 2, "sighting": 4, "kev": 0, "other": 2}}, "data": [{"timestamp": "2026-07-10T16:48:39.923Z", "date_only": false, "value": "2026-07-10T16:48:39.923Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-61564", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-28T21:42:42.397Z", "date_only": false, "value": "2026-10-28T21:42:42.397Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-61564", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-28T21:42:42.397Z", "date_only": false, "value": "2026-10-28T21:42:42.397Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-61564", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-28T21:42:42.397Z", "date_only": false, "value": "2026-10-28T21:42:42.397Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-61564", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-28T21:50:51.525Z", "date_only": false, "value": "2026-10-28T21:50:51.525313Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117520744513012458", "record": "CVE-2026-61564", "field": "creation_timestamp", "uuid": "6d51763f-97aa-4142-9586-505542ba236f", "content": "CVE-2026-61564 AVideo-Encoder: unauthenticated installer PHP code injection AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint `install/checkConfiguration.php` assembles `videos/configuration.php` by interpolating request parameters, including `webSiteRootURL`, into single-quoted PHP string literals without escaping. An attacker can terminate a literal and inject PHP that executes as the web-server user when the generated, directly requestable file is loaded. Exploitation requires `videos/configuration.php` to be absent, as on every fresh deployment or after the file is removed or moved; an existing file blocks this endpoint. The supplied `systemRootPath` must contain index.php and a connection using `databaseHost`, `databaseUser`, and `databasePass` must succeed, but the attacker can point those parameters to their own database server and needs no target credentials. The write location is also derived from `systemRootPath` without a base-directory constraint. This permits arbitrary command execution, reading and overwriting files owned by the web-server user, persistent PHP code, and control over stored database connection settings. The endpoint additionally interpolates request values into streamer and configuration INSERT statements, creating a secondary SQL-injection sink. This issue is fixed in version 8.1.0.\nhttps://www.cve.org/CVERecord?id=CVE-2026-61564https://github.com/WWBN/AVideo-Encoder/security/advisories/GHSA-xrj3-cqm8-r992https://github.com/WWBN/AVideo-Encoder/commit/0faaddebd11c087885d25a7e0513745465cad411https://github.com/WWBN/AVideo-Encoder/releases/tag/v8.1.0#WWBN #AVideo-Encoder#CVE_2026_61564#bot", "url": "https://infosec.exchange/users/cve/statuses/117520744513012458"}, {"timestamp": "2026-10-28T22:10:05.484Z", "date_only": false, "value": "2026-10-28T22:10:05.484434Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3myxrdnznta2v", "record": "CVE-2026-61564", "field": "creation_timestamp", "uuid": "10793881-9f87-4f3a-80cb-73d724f84b0f", "content": "CVE-2026-61564 - avideo-encoder\nThe AVideo video\u2011sharing platform\u2019s installer page can be accessed without logging in. An attacker can supply specially crafted data that writes a PHP file which the server\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#avideoencoder #wwbn #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3myxrdnznta2v"}, {"timestamp": "2026-10-28T22:32:20.561Z", "date_only": false, "value": "2026-10-28T22:32:20.561315Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aiuto-ch.bsky.social/post/3myxslfr2szq3", "record": "CVE-2026-61564", "field": "creation_timestamp", "uuid": "3f8fec9c-5066-468b-ba15-baa94ce56f92", "content": "CVE Radar | CVE-2026-61564 | CVSS 10.0\n\nAVideo Installer Enables Unauthenticated Code Execution\n\nCVE-2026-61564 affects AVideo versions before 8.1.0.\n\nFull analysis: https://t.me/aiutocomputerhelp_lab/1338", "url": "https://bsky.app/profile/aiuto-ch.bsky.social/post/3myxslfr2szq3"}, {"timestamp": "2026-10-29T00:07:37.954Z", "date_only": false, "value": "2026-10-29T00:07:37.954510Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3myxxvtxk662z", "record": "CVE-2026-61564", "field": "creation_timestamp", "uuid": "81a61bea-faaf-4163-9135-7ae1abd32603", "content": "\ud83d\udea8 CVE-2026-61564 \u2014 CVSS 10 CRITICAL\n\nAVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint `install/checkCo...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-61564\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3myxxvtxk662z"}], "metrics": {"as_of": "2026-10-29T22:25:35.930Z", "anchors": {"origin": {"timestamp": "2026-10-28T21:42:42.397Z", "date_only": false, "value": "2026-10-28T21:42:42.397Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-61564", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-28T21:42:42.397Z", "date_only": false, "value": "2026-10-28T21:42:42.397Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-61564", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 88973.533129, "hours": 24.71487031361111, "days": 1.0297862630671297, "min_seconds": 88973.533129, "max_seconds": 88973.533129, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-28T21:42:42.397Z", "date_only": false, "value": "2026-10-28T21:42:42.397Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-61564", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-29T22:25:35.930Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}