CVE-2026-28501CWE-89

WWBN AVideo: Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php

Critical · published March 6, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
72.6
In the wild
Unconfirmed
What it is

WWBN AVideo is an open source video platform. Prior to version 24.0, an unauthenticated SQL Injection vulnerability exists in AVideo within the objects/videos.json.php and objects/video.php components. The application fails to properly sanitize the catName parameter when it is supplied via a JSON-formatted POST request body. Because JSON input is parsed and merged into $_REQUEST after global security checks are executed, the payload bypasses the existing sanitization mechanisms. This issue has been patched in version 24.0.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01417 · 72.6th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-03-06T03:05Z
EPSS history
Timeline
  • 06 MAR 03:05Z
    WWBN AVideo: Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php
    cvelistv5