AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint "view/videosListToLive.php" accepts an attacker-named streamer in "webSiteRootURL", calls "Login::run" in "objects/Login.php", and trusts the returned JSON as session state. An unauthenticated remote attacker who can host an HTTP service reachable by the encoder can self-grant "isLogged" and "canStream" without legitimate credentials. The endpoint requires only nonempty "playlists_id" and "APISecret" values; "APISecret" is forwarded rather than checked against a stored secret. This path never calls "Streamer::isURLAllowed" and therefore works regardless of the operator's streamer allowlist. It fetches a second attacker-controlled video-list response and interpolates "videos[].path" without shell argument escaping into "ffprobe" and "ffmpeg" commands passed to "exec"; "isAudio" calls "isVideo" to reach the "ffprobe" command. Paths containing shell delimiters execute arbitrary operating-system commands as the web-server user. The request filter does not inspect the video-list JSON. This can disclose database and stored streamer credentials, compromise the upstream platform using those credentials, modify files owned by the web-server user, establish persistence, and deny encoder service. This issue is fixed in version 8.1.0.