CVE-2026-33493

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the "objects/import.json.php" endpoint accepts a user-controlled "fileURI" POST parameter with only a regex check that the value ends in ".mp4". Unlike "objects/listFiles.json.php", which was hardened with a...

Directory Traversal

Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to Directory Traversal in the import.json.php endpoint when handling the fileURI parameter. An authenticated user with upload permissions can access and copy private...

CVE-2024-12236: Improper Handling of Exceptional Conditions

A security issue exists in Vertex Gemini API for customers using VPC-SC. By utilizing a custom crafted file URI for image input, data exfiltration is possible due to requests being routed outside the VPC-SC security perimeter, circumventing the intended security restrictions of VPC-SC. No further...

WWBN AVideo import.json.php temporary copy unrestricted php file upload vulnerability

Talos Vulnerability Report TALOS-2023-1885 WWBN AVideo import.json.php temporary copy unrestricted php file upload vulnerability January 10, 2024 CVE Number CVE-2023-49715 SUMMARY A unrestricted php file upload vulnerability exists in the import.json.php temporary copy functionality of WWBN AVide...