CVE-2026-41304: high-severity vulnerability in WWBN AVideo
WWBN AVideo vulnerable to RCE caused by clonesite plugin
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
WWBN AVideo's CloneSite plugin allows attackers to run arbitrary commands on the server by injecting shell commands through the URL parameter. This happens because user input is directly used in a system command without being checked first.
The cloneServer.json.php endpoint in the CloneSite plugin constructs shell commands by concatenating unsanitized user input (url parameter) into a wget command executed via exec(), enabling command injection. An unauthenticated attacker can inject arbitrary shell metacharacters to break out of the intended URL context and achieve Remote Code Execution with server privileges.
In the same product, most dangerous first.