EUVD-2026-45040

WWBN AVideo is an open source video platform. Versions 29.0 and below remain vulnerable to OS command injection because the fix for CVE-2026-33482 was incomplete and still does not neutralize a single & the shell background operator. CVE-2026-33482 reported that sanitizeFFmpegCommand...

PT-2026-51639

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions 29.0 and earlier Description An OS command injection issue exists due to an incomplete fix for a previous vulnerability. The sanitizeFFmpegCommand function in plugin/API/standAlone/functions.php fails to neutralize the...

CVE-2026-33482

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the sanitizeFFmpegCommand function in plugin/API/standAlone/functions.php is designed to prevent OS command injection in ffmpeg commands by stripping dangerous shell metacharacters &&, ;, |, , . However, it fails ...

CVE-2026-33482

creationtimestamp| type| source ---|---|--- 2026-03-20 14:59:56+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-pmj8-r2j7-xg6c 2026-03-23 15:28:11+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhqereajdu2p 2026-03-23 16:15:54+00:0...