Unauthenticated SQL Injection Vulnerability in AVideo by WWBN

CVE-2026-84208

What is CVE-2026-84208?

The AVideo platform, specifically in version 29.0, features an unauthenticated SQL injection vulnerability found in the User_Location plugin. This security flaw exists in the regions.json.php and cities.json.php endpoints where GET parameters for country and region are directly included in SQL queries without proper escaping or the use of prepared statements. This oversight allows unauthenticated attackers to execute UNION-based SQL injections, leading to the potential exposure of sensitive database contents, including password hashes and other critical data.

References