Threats tagged 'ghsa-q2qg-2jgg-qfm6'

WWBN AVideo versions up to 29.7.1 have a missing authorization vulnerability in the objects/import.json.php endpoint. This flaw allows users with uploader privileges to import MP4 files from other users by referencing any folder under videos/. Exploitation enables attackers to copy private, unlisted, password-protected, or pay-per-view videos, read associated description files (.txt/.html), list files via objects/listFiles.json.php, and delete media using the delete parameter.