Threats tagged 'ghsa-vqg8-67mm-wh28'

WWBN AVideo versions prior to 29.5.0 have a local file inclusion (LFI) vulnerability. This flaw allows unauthenticated attackers to include and execute PHP files outside the intended locale directory by exploiting crafted Accept-Language headers. The vulnerability arises due to insufficient sanitization of traversal sequences like ....// in the setLanguage() function, enabling bypass of single-pass removal mechanisms.