CVE-2026-28501

critical · 9.8

WWBN AVideo is an open source video platform. Prior to version 24.0, an unauthenticated SQL Injection vulnerability exists in AVideo within the objects/videos.json.php and objects/video.php components. The application fails to properly sanitize the catName parameter when it is supplied via a JSON-formatted POST request body. Because JSON input is parsed and merged into $_REQUEST after global security checks are executed, the payload bypasses the existing sanitization mechanisms. This issue has been patched in version 24.0.

9.8

CVSS

1.5%

EPSS (exploit prob.)

73rd

EPSS percentile

2026-03-06

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-89

Affected products

Vendor	Product	Affected versions
wwbn	avideo	< 24.0

Check a specific version with /api/v1/cve/match.

References

https://github.com/WWBN/AVideo/commit/0c10be681c64044618ab94473251bd7c9b114fa1
https://github.com/WWBN/AVideo/releases/tag/24.0
https://github.com/WWBN/AVideo/security/advisories/GHSA-pv87-r9qf-x56p

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-28501