Home / Vulnerability Intelligence / CVE-2026-28501

CVE-2026-28501 - Vulnerability Analysis

CriticalCVSS: 9.8

Last Updated: March 6, 2026

WWBN AVideo - SQL Injection

Published: March 6, 2026Updated: March 6, 2026Remote Exploitable

Overview

WWBN AVideo < 24.0 contains an SQL injection caused by improper sanitization of the catName parameter in objects/videos.json.php and objects/video.php, letting unauthenticated attackers execute arbitrary SQL queries via JSON POST requests.

Severity & Score

Severity: Critical

CVSS Score: 9.8

Impact

Unauthenticated attackers can execute arbitrary SQL queries, potentially leading to data disclosure or modification.

Mitigation

Upgrade to version 24.0 or later.

References

https://github.com/WWBN/AVideo/commit/0c10be681c64044618ab94473251bd7c9b114fa1
https://github.com/WWBN/AVideo/releases/tag/24.0
https://github.com/WWBN/AVideo/security/advisories/GHSA-pv87-r9qf-x56p

Related Resources

Vulnerability Intelligence Dashboard
Credential Scanner

Details

CVE ID: CVE-2026-28501
Severity: Critical
CVSS Score: 9.8
Type: sql_injection
Status: new

CWE

CWE-89

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H