CVE-2026-90539

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 has a missing authentication flaw in the plugin/TopMenu/menuItems.json.php endpoint. An unauthenticated attacker can send a POST request with a menuId parameter to read inactive admin menu items, retrieving hidden menu item URLs ...