Loading...
Skip to main content
GeekWala

CVE-2026-28501 — Vulnerability in wwbn/avideo — CVE Details

CRITICAL

AVideo has Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php

Published March 2, 2026Updated March 6, 2026Source: osv

Summary

## Impact An unauthenticated SQL Injection vulnerability exists in AVideo within the objects/videos.json.php and objects/video.php components. The application fails to properly sanitize the catName parameter when it is supplied via a JSON-formatted POST request body. Because JSON input is parsed and merged into $_REQUEST after global security checks are executed, the payload bypasses the existing sanitization mechanisms. This allows an unauthenticated attacker to: - Execute arbitrary SQL queries - Perform full database exfiltration - Extract sensitive data including administrator usernames, password hashes, session identifiers and user records - Potentially escalate privileges by cracking password hashes offline - Chain with authenticated vulnerabilities to achieve full system compromise This vulnerability is classified as: - CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) ## Patches This vulnerability has been fixed in version 23. Users must upgrade to version 23 or later. ## Workarounds There is no reliable workaround. The only recommended mitigation is to upgrade immediately to version 23 upon its release. ## References Internal security report.

Advisory Timeline

  • First published March 2, 2026 (224 days ago).
  • Last revised March 6, 2026 — 4 days after initial publication.

Affected Packages (1)

Affects 1 ecosystem: packagist (1).

PackageEcosystemAffectedFixed In
wwbn/avideo
packagist
10.4, 10.8, 11, 11.1 (+9 more)Range-based data available

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2026-28501?
AVideo has Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2026-28501?
CVE-2026-28501 affects wwbn/avideo. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-28501 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-pv87-r9qf-x56p

Related CVEs

  • CVE-2026-29058
    CRITICAL

    WWBN AVideo is vulnerable to unauthenticated OS Command Injection via base64Url in objects/getImage.php

  • CVE-2026-40911
    CRITICAL

    WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks

  • CVE-2026-33352
    CRITICAL

    AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass)

  • CVE-2024-31819
    CRITICAL

    WWBN AVideo Remote Code Execution

  • CVE-2023-25313
    CRITICAL

    AVideo contains Command injection when embedding a video link

  • CVE-2026-33039
    HIGH

    AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy

  • CVE-2026-33507
    HIGH

    AVideo Affected by CSRF on Plugin Import Endpoint Enables Unauthenticated Remote Code Execution via Malicious Plugin Upload

  • CVE-2026-33480
    HIGH

    AVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks Proxy

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies