SQL Injection Vulnerability in WWBN AVideo Affected Framework

CVE-2026-85155

What is CVE-2026-85155?

A serious SQL injection vulnerability exists in the sort column parameter of the get.json.php endpoint for the APIName=channels in WWBN AVideo. This allows unauthenticated attackers to exploit the application by manipulating query parameters, effectively gaining access to sensitive information including password hash values and recovery tokens. Furthermore, attackers can leverage this weakness to trigger SQL errors that reveal the complete SQL query and underlying database schema, putting user data at significant risk.

References