CVE-2026-28501
🟠 Łataj w tym tygodniu
Wstrzyknięcie SQL w AVideo przed wersją 24.0 umożliwia nieautoryzowany dostęp do bazy danych, co może prowadzić do kradzieży danych.
CVSS
9.8
EPSS
0.0%
Exploit
none
Vendor
wwbn
Opis źródłowy (NVD)
WWBN AVideo is an open source video platform. Prior to version 24.0, an unauthenticated SQL Injection vulnerability exists in AVideo within the objects/videos.json.php and objects/video.php components. The application fails to properly sanitize the catName parameter when it is supplied via a JSON-formatted POST request body. Because JSON input is parsed and merged into $_REQUEST after global security checks are executed, the payload bypasses the existing sanitization mechanisms. This issue has been patched in version 24.0.
sql-injection
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 9.8 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 0.0% |
| Opublikowano (NVD) | 2026-03-06 04:16:08 UTC |
| Ostatnia modyfikacja (NVD) | 2026-03-16 15:06:55 UTC |
Referencje
- https://github.com/WWBN/AVideo/commit/0c10be681c64044618ab94473251bd7c9b114fa1 (security-advisories@github.com) [Patch]
- https://github.com/WWBN/AVideo/releases/tag/24.0 (security-advisories@github.com) [Product, Release Notes]
- https://github.com/WWBN/AVideo/security/advisories/GHSA-pv87-r9qf-x56p (security-advisories@github.com) [Vendor Advisory]