CVE-2026-28501

CVE-2026-28501 is an unauthenticated SQL injection vulnerability (CWE-89) affecting WWBN AVideo, an open-source video platform, in versions prior to 24.0. The flaw resides in the objects/videos.json.php and objects/video.php components, where the catName parameter supplied via a JSON-formatted POST request body is not properly sanitized. JSON input is parsed and merged into the $_REQUEST superglobal after global security checks have executed, allowing payloads to bypass existing sanitization mechanisms. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity.

Any unauthenticated attacker with network access can exploit this vulnerability by sending a crafted JSON POST request to the affected endpoints, injecting malicious SQL via the catName parameter. Successful exploitation could enable arbitrary SQL query execution, potentially leading to full database compromise, including data exfiltration, modification, or deletion, as well as server-side availability disruption.

The issue has been addressed in AVideo version 24.0, as detailed in the project's GitHub security advisory (GHSA-pv87-r9qf-x56p), release notes, and the patching commit. Security practitioners should upgrade to version 24.0 or later and review access logs for suspicious POST requests to the affected components.