https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 17 Oct 2026 15:51:14 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-277215 EUVD-2026-277215 https://cve.radiocsirt.org/vuln/euvd-2026-277215 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33681 <p>WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/pluginRunDatabaseScript.json.php` endpoint accepts a `name` parameter via POST and passes it to `Plugin::getDatabaseFileName()` without any path traversal sanitization. This allows an authenticated admin (or an attacker via CSRF) to traverse outside the plugin directory and execute the contents of any `install/install.sql` file on the filesystem as raw SQL queries against the application database. Commit 81b591c509835505cb9f298aa1162ac64c4152cb contains a patch.</p> <p>WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/pluginRunDatabaseScript.json.php` endpoint accepts a `name` parameter via POST and passes it to `Plugin::getDatabaseFileName()` without any path traversal sanitization. This allows an authenticated admin (or an attacker via CSRF) to traverse outside the plugin directory and execute the contents of any `install/install.sql` file on the filesystem as raw SQL queries against the application database. Commit 81b591c509835505cb9f298aa1162ac64c4152cb contains a patch.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-33681 https://cve.radiocsirt.org/vuln/ghsa-3hwv-x8g3-9qpr <p><strong>Affected:</strong> Packagist: wwbn/avideo</p> <p>## Summary</p> <p>The `objects/pluginRunDatabaseScript.json.php` endpoint accepts a `name` parameter via POST and passes it to `Plugin::getDatabaseFileName()` without any path traversal sanitization. This allows an authenticated admin (or an attacker via CSRF) to traverse outside the plugin directory and execute the contents of any `install/install.sql` file on the filesystem as raw SQL queries against the application database.</p> <p>## Details</p> <p>The vulnerable data flow:</p> <p>**1. Entry point** — `objects/pluginRunDatabaseScript.json.php:21`: ```php $fileName = Plugin::getDatabaseFileName($_POST[&#39;name&#39;]); ```</p> <p>**2. &#34;Sanitization&#34;** — `objects/plugin.php:343-354`: ```php public static function getDatabaseFileName($pluginName) { global $global; $pluginName = AVideoPlugin::fixName($pluginName); // line 347 — no-op $dir = $global[&#39;systemRootPath&#39;] . &#34;plugin&#34;; $filename = $dir . DIRECTORY_SEPARATOR . $pluginName . DIRECTORY_SEPARATOR . &#34;install&#34; . DIRECTORY_SEPARATOR . &#34;install.sql&#34;; if (!file_exists($filename)) { return false; } return $filename; } ```</p> <p>**3. The &#34;fix&#34;** — `plugin/AVideoPlugin.php:3184-3190`: ```php public static function fixName($name) { if ($name === &#39;Programs&#39;) { return &#39;PlayLists&#39;; } return $name; // Returns input unchanged for all other values } ```</p> <p>**4. SQL execution** — `objects/pluginRunDatabaseScript.json.php:24-36`: ```php $lines = file($fileName); foreach ($lines as $line) { // ... if (!$global[&#39;mysql…</p> <p><strong>Affected:</strong> Packagist: wwbn/avideo</p> <p>## Summary</p> <p>The `objects/pluginRunDatabaseScript.json.php` endpoint accepts a `name` parameter via POST and passes it to `Plugin::getDatabaseFileName()` without any path traversal sanitization. This allows an authenticated admin (or an attacker via CSRF) to traverse outside the plugin directory and execute the contents of any `install/install.sql` file on the filesystem as raw SQL queries against the application database.</p> <p>## Details</p> <p>The vulnerable data flow:</p> <p>**1. Entry point** — `objects/pluginRunDatabaseScript.json.php:21`: ```php $fileName = Plugin::getDatabaseFileName($_POST[&#39;name&#39;]); ```</p> <p>**2. &#34;Sanitization&#34;** — `objects/plugin.php:343-354`: ```php public static function getDatabaseFileName($pluginName) { global $global; $pluginName = AVideoPlugin::fixName($pluginName); // line 347 — no-op $dir = $global[&#39;systemRootPath&#39;] . &#34;plugin&#34;; $filename = $dir . DIRECTORY_SEPARATOR . $pluginName . DIRECTORY_SEPARATOR . &#34;install&#34; . DIRECTORY_SEPARATOR . &#34;install.sql&#34;; if (!file_exists($filename)) { return false; } return $filename; } ```</p> <p>**3. The &#34;fix&#34;** — `plugin/AVideoPlugin.php:3184-3190`: ```php public static function fixName($name) { if ($name === &#39;Programs&#39;) { return &#39;PlayLists&#39;; } return $name; // Returns input unchanged for all other values } ```</p> <p>**4. SQL execution** — `objects/pluginRunDatabaseScript.json.php:24-36`: ```php $lines = file($fileName); foreach ($lines as $line) { // ... if (!$global[&#39;mysql…</p> https://cve.radiocsirt.org/vuln/ghsa-3hwv-x8g3-9qpr