CVE-2026-33237

WWBN AVideo is an open source video platform. Prior to version 26.0, the Scheduler plugin's "run" function in "plugin/Scheduler/Scheduler.php" calls "urlgetcontents" with an admin-configurable "callbackURL" that is validated only by "isValidURL" URL format check. Unlike other AVideo endpoints tha...