PHP CVE-2026-28501
CRITICAL
GHSA-pv87-r9qf-x56p
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
WWBN AVideo is an open source video platform. Prior to version 24.0, an unauthenticated SQL Injection vulnerability exists in AVideo within the objects/videos.json.php and objects/video.php components. The application fails to properly sanitize the catName parameter when it is supplied via a JSON-formatted POST request body. Because JSON input is parsed and merged into $_REQUEST after global security checks are executed, the payload bypasses the existing sanitization mechanisms. This issue has been patched in version 24.0.
AnalysisAI
Unauthenticated SQL injection in AVideo before 24.0.
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Inventory all AVideo deployments and confirm affected versions; isolate or restrict external access to AVideo instances pending remediation. Within 7 days: Deploy Web Application Firewall (WAF) rules to block SQL injection patterns; implement database activity monitoring; consider disabling public-facing AVideo features if risk tolerance is low. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today