AVideo is a video-sharing Platform. Before the initial remediation attempt in 8.1.0, url_get_contents in objects/functions.php accepts caller-controlled destinations after only FILTER_VALIDATE_URL syntax validation, without rejecting private, loopback, or link-local addresses, and disables TLS peer verification. Login::isLogged reauthenticates using the attacker-settable encoder_aVideoURL cookie together with arbitrary nonempty encoder_user and encoder_pass cookies, and Login::run stores the raw fetched body in result. The unauthenticated objects/login.json.php endpoint returns that session object, enabling full-response exfiltration through a supplied siteURL; its Streamer::isURLAllowed gate allows all sites when the operator allowlist is empty, the default. An unauthenticated remote…