https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-18T01:53:27.100168+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-274796 EUVD-2026-274796 2026-10-18T01:53:27.154760+00:00 EUVD-2026-274796 https://cve.radiocsirt.org/vuln/fkie_cve-2026-28501 fkie_cve-2026-28501 2026-10-18T01:53:27.154801+00:00

WWBN AVideo is an open source video platform. Prior to version 24.0, an unauthenticated SQL Injection vulnerability exists in AVideo within the objects/videos.json.php and objects/video.php components. The application fails to properly sanitize the catName parameter when it is supplied via a JSON-formatted POST request body. Because JSON input is parsed and merged into $_REQUEST after global security checks are executed, the payload bypasses the existing sanitization mechanisms. This issue has been patched in version 24.0.

 https://cve.radiocsirt.org/vuln/ghsa-pv87-r9qf-x56p GHSA-pv87-r9qf-x56p — AVideo has Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php 2026-10-18T01:53:27.154837+00:00

Affected: Packagist: wwbn/avideo

## Impact

An unauthenticated SQL Injection vulnerability exists in AVideo within the objects/videos.json.php and objects/video.php components.

The application fails to properly sanitize the catName parameter when it is supplied via a JSON-formatted POST request body. Because JSON input is parsed and merged into $_REQUEST after global security checks are executed, the payload bypasses the existing sanitization mechanisms.

This allows an unauthenticated attacker to:

- Execute arbitrary SQL queries - Perform full database exfiltration - Extract sensitive data including administrator usernames, password hashes, session identifiers and user records - Potentially escalate privileges by cracking password hashes offline - Chain with authenticated vulnerabilities to achieve full system compromise

This vulnerability is classified as: - CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)

## Patches

This vulnerability has been fixed in version 23.

Users must upgrade to version 23 or later.

## Workarounds

There is no reliable workaround.

The only recommended mitigation is to upgrade immediately to version 23 upon its release.

## References

Internal security report.