Home / Vulnerability Intelligence / CVE-2026-34374

CVE-2026-34374 - Vulnerability Analysis

CriticalCVSS: 9.1

Last Updated: March 27, 2026

WWBN AVideo - SQL Injection

Published: March 27, 2026Updated: March 27, 2026Remote Exploitable

Overview

WWBN AVideo <= 26.0 contains a SQL injection caused by unparameterized interpolation of stream key in Live_schedule::keyExists(), letting attackers execute arbitrary SQL commands during RTMP publish authentication, exploit requires crafted stream key.

Severity & Score

Severity: Critical

CVSS Score: 9.1

Impact

Attackers can execute arbitrary SQL commands, potentially leading to data disclosure or modification.

Mitigation

Update to the latest version once a patch is available.

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-xgv5-66wp-ch88

Related Resources

Vulnerability Intelligence Dashboard
Credential Scanner

Details

CVE ID: CVE-2026-34374
Severity: Critical
CVSS Score: 9.1
Type: sql_injection
Status: new

CWE

CWE-89

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N