CVE-2026-33512

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the API plugin exposes a "decryptString" action without any authentication. Anyone can submit ciphertext and receive plaintext. Ciphertext is issued publicly e.g., "view/url2Embed.json.php", so any user can recove...