CVE-2026-33681

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the "objects/pluginRunDatabaseScript.json.php" endpoint accepts a "name" parameter via POST and passes it to "Plugin::getDatabaseFileName" without any path traversal sanitization. This allows an authenticated admi...

CVE-2026-33681: Improper Limitation of a Pathname to a Restricted Directory

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the objects/pluginRunDatabaseScript.json.php endpoint accepts a name parameter via POST and passes it to Plugin::getDatabaseFileName without any path traversal sanitization. This allows an authenticated admin or a...