WWBN — AVideo
WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in objects/import.json.php that allows uploaders to import other users' MP4 files by referencing any folder under videos/. Attackers can copy private, unlisted, password-protected or pay-per-view videos, read victims' .txt/.html sidecars as descriptions, list files via objects/listFiles.json.php, and delete victims' media using the delete parameter.
Available for technologies you monitor inside Seraph CTI.
Surfaced automatically when a documented actor is linked to this CVE.
Shown when this vendor/product is relevant to your industry.
Campaign and indicator context, where Seraph analysts have published it.
Declare your technology stack inside Seraph CTI and get notified the moment a vulnerability matches it.
