WWBN AVideo contains a path traversal vulnerability in plugin/AI/receiveAsync.json.php that allows holders of any valid AI token to write arbitrary…
WWBN AVideo contains a path traversal vulnerability in plugin/AI/receiveAsync.json.php that allows holders of any valid AI token to write arbitrary .vtt files by injecting traversal sequences into the unsanitized response[lang] parameter. Attackers can send a type=translation request with a crafted lang value to plant attacker-controlled content in the webroot or overwrite other users' subtitle files.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- WWBN
- Product
- AVideo
- CVSS v3.1
- 7.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
- Weakness
- CWE-22
- NVD status
- Deferred
Why it ranks 12 (Routine)
- CVSS v3.1 7.1 high
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.