SQL Injection Vulnerability in WWBN AVideo Open Source Video Platform

CVE-2026-33723

What is CVE-2026-33723?

The WWBN AVideo platform is exposed to a SQL injection vulnerability due to improper handling of user input in the Subscribe::save() method. This flaw occurs because the $this->users_id property, sourced from unvalidated $_POST['user_id'], is directly concatenated into an SQL query. This oversight allows attackers with valid authentication to execute arbitrary SQL commands, potentially exposing sensitive information such as password hashes, API keys, and encryption salts from the database. A patch has been implemented to address this issue.

References