EIP-2026-105038

The exploit describes two vulnerabilities in airVisionNVR: a local file disclosure via PHP's readfile() function and a time-based blind SQL injection in the 'id' parameter of ajax/event.php. No actual exploit code is provided, only descriptions and example payloads.