What is the CVSS score of EUVD-2026-14508?

EUVD-2026-14508 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by EUVD-2026-14508?

WWBN AVideo installations are vulnerable to SQL injection attacks by authenticated users, enabling attackers to extract sensitive data including password hashes, API keys, and encryption salts.

How to fix or mitigate EUVD-2026-14508?

Within 24 hours: Identify all WWBN AVideo instances in your environment and restrict access to trusted networks only; audit recent user account activity for suspicious behavior. Within 7 days: Implement Web Application Firewall rules to block SQL injection patterns in POST requests to the Subscribe module; enforce principle of least privilege on database accounts. Within 30 days: Evaluate alternative video platforms or closed-source solutions; if continuing to use AVideo, monitor vendor repositories for available patches and prepare for immediate deployment.

PHP EUVD-2026-14508

| CVE-2026-33723 HIGH

SQL Injection (CWE-89)

2026-03-23 GitHub_M

GHSA-ffr8-fxhv-fv8h

PHP Information Disclosure SQLi

7.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 23, 2026 - 19:00 euvd

EUVD-2026-14508

Analysis Generated

Mar 23, 2026 - 19:00 vuln.today

CVE Published

Mar 23, 2026 - 18:50 nvd

HIGH 7.1

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the Subscribe::save() method in objects/subscribe.php concatenates the $this->users_id property directly into an INSERT SQL query without sanitization or parameterized binding. This property originates from $_POST['user_id'] in both subscribe.json.php and subscribeNotify.json.php. An authenticated attacker can inject arbitrary SQL to extract sensitive data from any database table, including password hashes, API keys, and encryption salts. Commit 36dfae22059fbd66fd34bbc5568a838fc0efd66c contains a patch.

AnalysisAI

WWBN AVideo, an open source video platform, contains a SQL injection vulnerability in the Subscribe::save() method that allows authenticated attackers to execute arbitrary SQL queries. Versions up to and including 26.0 are affected, with the vulnerability stemming from unsanitized user input from the $_POST['user_id'] parameter being concatenated directly into INSERT queries. An attacker with low-level authentication can extract sensitive data including password hashes, API keys, and encryption salts from the database, representing a significant information disclosure risk.

Technical ContextAI

The vulnerability affects WWBN AVideo (CPE: cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*), specifically the Subscribe class implementation in objects/subscribe.php and its consumers subscribe.json.php and subscribeNotify.json.php. This is a classic CWE-89 SQL Injection flaw where the $this->users_id property, populated directly from POST request data, is concatenated into SQL INSERT statements without parameterized queries or input sanitization. PHP applications that construct SQL queries through string concatenation rather than prepared statements are vulnerable to this attack class. The vulnerability allows attackers to break out of the intended SQL context and inject additional SQL commands, enabling unauthorized database access beyond the application's intended data access patterns.

RemediationAI

Apply the patch available in commit 36dfae22059fbd66fd34bbc5568a838fc0efd66c from the WWBN AVideo repository at https://github.com/WWBN/AVideo/commit/36dfae22059fbd66fd34bbc5568a838fc0efd66c, which addresses the SQL injection by implementing proper input sanitization or parameterized queries in the Subscribe::save() method. Organizations should upgrade to a version containing this commit or manually apply the patch to their existing installations. Until patching is complete, consider implementing Web Application Firewall (WAF) rules to detect and block SQL injection attempts targeting the subscribe.json.php and subscribeNotify.json.php endpoints, and review authentication mechanisms to ensure only trusted users have access to the platform. Conduct a security audit of database access logs to identify any potential exploitation attempts prior to patching.