Unauthenticated SQL Injection in WWBN AVideo Open Source Video Platform
CVE-2026-28501

9.8CRITICAL

Key Information:

Vendor

Wwbn

Status
Avideo
Vendor
CVE Published:
6 March 2026

What is CVE-2026-28501?

WWBN AVideo, an open-source video platform, has a vulnerability that allows for unauthenticated SQL Injection attacks affecting users of versions prior to 24.0. The flaw is rooted in the failure to adequately sanitize the catName parameter in JSON-formatted POST requests within the objects/videos.json.php and objects/video.php files. As the JSON input is merged into the $_REQUEST array post-security checks, it effectively circumvents existing protections designed to ensure security. This vulnerability was addressed in the release of version 24.0.

Affected Version(s)

AVideo < 24.0

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-p...
x_refsource_CONFIRM
https://github.com/WWBN/AVideo/commit/0c10be681c64044618a...
x_refsource_MISC
https://github.com/WWBN/AVideo/releases/tag/24.0
x_refsource_MISC

EPSS Score

22% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.