https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-17T18:12:28.647669+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-277227 EUVD-2026-277227 2026-10-17T18:12:28.649731+00:00 EUVD-2026-277227 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33352 fkie_cve-2026-33352 2026-10-17T18:12:28.649765+00:00

WWBN AVideo is an open source video platform. Prior to version 26.0, an unauthenticated SQL injection vulnerability exists in `objects/category.php` in the `getAllCategories()` method. The `doNotShowCats` request parameter is sanitized only by stripping single-quote characters (`str_replace("'", '', ...)`), but this is trivially bypassed using a backslash escape technique to shift SQL string boundaries. The parameter is not covered by any of the application's global input filters in `objects/security.php`. Version 26.0 contains a patch for the issue.

 https://cve.radiocsirt.org/vuln/ghsa-mcj5-6qr4-95fj GHSA-mcj5-6qr4-95fj — AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass) 2026-10-17T18:12:28.649797+00:00

Affected: Packagist: wwbn/avideo

### Summary

An unauthenticated SQL injection vulnerability exists in `objects/category.php` in the `getAllCategories()` method. The `doNotShowCats` request parameter is sanitized only by stripping single-quote characters (`str_replace("'", '', ...)`), but this is trivially bypassed using a backslash escape technique to shift SQL string boundaries. The parameter is not covered by any of the application's global input filters in `objects/security.php`.

### Affected Component

**File:** `objects/category.php`, lines 386-394, inside method `getAllCategories()`

```php if (!empty($_REQUEST['doNotShowCats'])) { $doNotShowCats = $_REQUEST['doNotShowCats']; if (!is_array($_REQUEST['doNotShowCats'])) { $doNotShowCats = array($_REQUEST['doNotShowCats']); } foreach ($doNotShowCats as $key => $value) { $doNotShowCats[$key] = str_replace("'", '', $value); // INSUFFICIENT } $sql .= " AND (c.clean_name NOT IN ('" . implode("', '", $doNotShowCats) . "') )"; } ```

### Root Cause

1. **Incomplete sanitization:** The only defense is `str_replace("'", '', $value)`, which strips single-quote characters. It does **not** strip backslashes (`\`). 2. **No global filter coverage:** The `doNotShowCats` parameter is absent from every filter list in `objects/security.php` (`$securityFilter`, `$securityFilterInt`, `$securityRemoveSingleQuotes`, `$securityRemoveNonChars`, `$securityRemoveNonCharsStrict`, `$filterURL`, and the `_id` suffix pattern). 3. **Direct s…