WWBN AVideo is an open source video platform. In versions up to and including 29.0, an incomplete fix for AVideo's `test.php` adds `escapeshellarg` for wget but…

WWBN AVideo, an open source video platform, contains a vulnerability in versions up to 29.0 where an incomplete fix for test.php adds escapeshellarg for wget but leaves file_get_contents and curl code paths unsanitized. The URL validation regex /^http/ accepts malicious strings like httpevil.com, allowing potential exploitation. This represents an incomplete security fix that leaves multiple attack vectors open for exploitation through unsanitized input handling.