CVE-2026-90541

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is vulnerable to an unauthenticated information disclosure via the plugin/TopMenu/menus.json.php endpoint. The endpoint fails to enforce authentication, allowing any attacker to send a simple GET request and retrieve the full men...