Search: CVE-2026-41304

CVE-2026-41304 is a command injection vulnerability in WWBN AVideo versions 29.0 and below. The vulnerability exists in the CloneSite plugin's cloneServer.json.php endpoint, where user input from the 'url' parameter is unsafely concatenated into a shell command executed via exec(). This allows an attacker to inject arbitrary shell commands, leading to remote code execution on the server. A fix for this issue is included in commit 473c609fc2defdea8b937b00e86ce88eba1f15bb.