CVE-2026-33681

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the "objects/pluginRunDatabaseScript.json.php" endpoint accepts a "name" parameter via POST and passes it to "Plugin::getDatabaseFileName" without any path traversal sanitization. This allows an authenticated admi...