Threats tagged 'ghsa-wh2h-gv9f-j9wp'

WWBN AVideo has a path traversal vulnerability in the plugin/AI/receiveAsync.json.php endpoint. This flaw allows any user with a valid AI token to write arbitrary .vtt subtitle files by injecting directory traversal sequences into the unsanitized 'response[lang]' parameter. Attackers can exploit this by sending a type=translation request with a crafted 'lang' value to place malicious content in the webroot or overwrite subtitle files belonging to other users.