Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
WWBN AVideo is an open source video platform. Prior to version 24.0, an authenticated Remote Code Execution (RCE) vulnerability was identified in AVideo related to the plugin upload/import functionality. The issue allowed an authenticated administrator to upload a specially crafted ZIP archive containing executable server-side files. Due to insufficient validation of extracted file contents, the archive was extracted directly into a web-accessible plugin directory, allowing arbitrary PHP code execution. This issue has been patched in version 24.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-28502 WWBN AVideo is an open source video platform. Prior to version 24.0, an authenticated Remote Code Execution (RCE) vulnerability was identified in AVideo related to th… https://www.cve.org/CVERecord?id=CVE-2026-28502
Post summary
The statement announces an authenticated RCE flaw in AVideo versions before 24.0, providing technical details but no exploit or patch information.
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-28502 - WWBN AVideo: Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction Intel Report: https://ift.tt/fRvk5A0
Post summary
This alert announces CVE-2026-28502 in WWBN AVideo, describing an authenticated RCE via unsafe ZIP extraction, but provides no PoC, exploit code, active-use evidence, or patch details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | wwbn | avideo | - | - | - |