CVE-2026-34247

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the "plugin/Live/uploadPoster.php" endpoint allows any authenticated user to overwrite the poster image for any scheduled live stream by supplying an arbitrary "livescheduleid". The endpoint only checks...