Threats tagged 'ghsa-h557-gp8h-jfv2'

WWBN AVideo versions up to 29.7.1 have a missing authorization vulnerability in the API::get_api_tags() function within the plugin/API/API.php file. This flaw allows registered users to access restricted video data by querying the tags API. Exploitation enables attackers to subscribe to tags and retrieve filenames, titles, and stored video_password values of unlisted, group-restricted, and password-protected videos, potentially allowing unauthorized viewing.