CVE-2026-33485 - Vulnerability Analysis

Overview

WWBN AVideo <= 26.0 contains a time-based blind SQL injection caused by unsanitized interpolation of the 'name' parameter in SQL queries in plugin/Live/on_publish.php, letting unauthenticated attackers extract sensitive database contents, exploit requires no authentication.

Severity & Score

Impact

Unauthenticated attackers can extract sensitive database data including user credentials and emails, leading to full data disclosure.

Mitigation

Update to a version including commit af59eade82de645b20183cc3d74467a7eac76549 or later.

References

• https://github.com/WWBN/AVideo/security/advisories/GHSA-8p58-35c3-ccxx
• https://github.com/WWBN/AVideo/commit/af59eade82de645b20183cc3d74467a7eac76549

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 23, 2026

🟠 CVE-2026-33485 - High (7.5) WWBN AVideo is an open source video platform. In versions up to and including 26.0, the RTMP `on_publish` callback at `plugin/Live/on_publish.php` is accessible without authentication. The `$_POST['name']` parameter (stream key) is interpolated di... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33485/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner