What is the CVSS score of CVE-2026-33651?

CVE-2026-33651 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-33651?

A high-severity SQL injection vulnerability in WWBN AVideo allows authenticated users to extract sensitive data including credentials and user information from your database.

How to fix or mitigate CVE-2026-33651?

Within 24 hours: Identify all systems running AVideo and assess whether the remindMe.json.php endpoint is publicly accessible; isolate affected instances if possible. Within 7 days: Apply the security patch from commit 75d45780728294ededa1e3f842f95295d3e7d144 or upgrade to the patched version; verify patch deployment across all instances. Within 30 days: Conduct database audit for unauthorized access or exfiltration; review access logs for the remindMe.json.php endpoint; reset credentials for all system and user accounts as a precautionary measure.

PHP CVE-2026-33651

EUVD-2026-14490 HIGH

SQL Injection (CWE-89)

2026-03-23 GitHub_M

GHSA-pvw4-p2jm-chjm

PHP SQLi

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 23, 2026 - 19:00 euvd

EUVD-2026-14490

Analysis Generated

Mar 23, 2026 - 19:00 vuln.today

CVE Published

Mar 23, 2026 - 18:38 nvd

HIGH 8.1

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the remindMe.json.php endpoint passes $_REQUEST['live_schedule_id'] through multiple functions without sanitization until it reaches Scheduler_commands::getAllActiveOrToRepeat(), which directly concatenates it into a SQL LIKE clause. Although intermediate functions (new Live_schedule(), getUsers_idOrCompany()) apply intval() internally, they do so on local copies within ObjectYPT::getFromDb(), leaving the original tainted variable unchanged. Any authenticated user can perform time-based blind SQL injection to extract arbitrary database contents. Commit 75d45780728294ededa1e3f842f95295d3e7d144 contains a patch.

AnalysisAI

SQL injection in WWBN AVideo up to version 26.0 allows authenticated users to extract arbitrary database contents through time-based blind SQL injection via the remindMe.json.php endpoint. The vulnerability stems from insufficient input sanitization of the live_schedule_id parameter, which is concatenated directly into a SQL LIKE clause despite partial validation in intermediate functions. No patch is currently available.

Technical ContextAI

This vulnerability affects WWBN AVideo (CPE: cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*), a PHP-based open source video streaming and management platform. The root cause is CWE-89 (SQL Injection), specifically occurring when the live_schedule_id parameter from user requests passes through multiple functions including Live_schedule constructor and getUsers_idOrCompany without proper sanitization. Although intermediate functions apply intval() for type casting, they operate on local copies within ObjectYPT::getFromDb(), leaving the original tainted variable intact. This tainted input eventually reaches Scheduler_commands::getAllActiveOrToRepeat() where it is directly concatenated into a SQL LIKE clause, enabling time-based blind SQL injection attacks that allow attackers to infer database contents through response timing differentials.

RemediationAI

Apply the patch provided in commit 75d45780728294ededa1e3f842f95295d3e7d144 available at https://github.com/WWBN/AVideo/commit/75d45780728294ededa1e3f842f95295d3e7d144, which addresses the SQL injection by properly sanitizing the live_schedule_id parameter before database operations. Organizations should upgrade to a patched version beyond 26.0 that incorporates this commit. Review the GitHub security advisory at https://github.com/WWBN/AVideo/security/advisories/GHSA-pvw4-p2jm-chjm for additional guidance from the vendor. As an interim mitigation while patching, consider implementing web application firewall rules to detect and block SQL injection attempts targeting the remindMe.json.php endpoint, restrict database user permissions to minimize potential data exposure, and audit user accounts to ensure only trusted users have authentication credentials. Monitor database query logs for suspicious LIKE clause patterns or unusually slow queries that may indicate exploitation attempts.