Threats tagged 'ghsa-xrj9-8wxh-8mww'

WWBN AVideo versions 12.4 through 29.7.1 have a path traversal vulnerability in the ADs plugin's deleteImage.json.php endpoint. Authenticated users with custom ads can exploit this flaw by manipulating the is_regular_user parameter to delete arbitrary files, including other users' ads or critical site files such as videos/configuration.php. This can lead to site downtime and re-exposure of the installer.