CVE-2026-33352

WWBN AVideo is an open source video platform. Prior to version 26.0, an unauthenticated SQL injection vulnerability exists in objects/category.php in the getAllCategories method. The doNotShowCats request parameter is sanitized only by stripping single-quote characters strreplace"'", '', ..., but...

CVE-2026-33238

The connected GitHub advisory describes a path traversal in AVideo’s listFiles.json.php where an authenticated user with canUpload can pass an arbitrary path to glob(), returning full absolute paths to MP4 files anywhere on the server. This enables enumeration of web-root, private/premium content...