High severity8.8NVD Advisory· Published Apr 28, 2023· Updated Jun 17, 2026

CVE-2023-30854

Description

AVideo is an open source video platform. Prior to version 12.4, an OS Command Injection vulnerability in an authenticated endpoint /plugin/CloneSite/cloneClient.json.php allows attackers to achieve Remote Code Execution. This issue is fixed in version 12.4.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
wwbn/avideoPackagist	< 12.4	12.4

Affected products

WWBN/Avideo2 versions
cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*range: <12.4
- (no CPE)range: < 12.4
ghsa-coords
pkg:composer/wwbn/avideo
Range: < 12.4

Patches

Vulnerability mechanics

References

github.com/WWBN/AVideo/security/advisories/GHSA-6vrj-ph27-qfp3nvdExploitVendor AdvisoryWEB
github.com/advisories/GHSA-6vrj-ph27-qfp3ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2023-30854ghsaADVISORY
github.com/WWBN/AVideo/commit/020415d22f36d93ed865eb61994b49caa0f7f90aghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.004
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000