https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-18T03:14:51.311061+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-28501 CVE-2026-28501 — WWBN AVideo: Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php 2026-10-18T03:14:51.312244+00:00

Affected: WWBN AVideo

WWBN AVideo is an open source video platform. Prior to version 24.0, an unauthenticated SQL Injection vulnerability exists in AVideo within the objects/videos.json.php and objects/video.php components. The application fails to properly sanitize the catName parameter when it is supplied via a JSON-formatted POST request body. Because JSON input is parsed and merged into $_REQUEST after global security checks are executed, the payload bypasses the existing sanitization mechanisms. This issue has been patched in version 24.0.