WWBN AVideo has an incomplete fix for CVE-2026-33502: Command Injection

Summary The incomplete fix for AVideo's test.php adds escapeshellarg for wget but leaves the filegetcontents and curl code paths unsanitized, and the URL validation regex /^http/ accepts strings like httpevil.com. Affected Package - Ecosystem: Other - Package: AVideo - Affected versions: = commit...

PT-2019-20025

Name of the Vulnerable Software and Affected Versions GUN versions prior to 0.2019.416 Description A serious issue was found in the static file server module included with GUN, where using curl --path-as-is allowed reads on any parent directory or files. This issue did not affect requests made vi...