Home

Description

WWBN AVideo is an open source video platform. In versions up to and including 26.0, in `objects/like.php`, the `getLike()` method constructs a SQL query using a prepared statement placeholder (`?`) for `users_id` but directly concatenates `$this->videos_id` into the query string without parameterization. An attacker who can control the `videos_id` value (via a crafted request) can inject arbitrary SQL, bypassing the partial prepared-statement protection. Commit 0215d3c4f1ee748b8880254967b51784b8ac4080 contains a patch.

PUBLISHED Reserved 2026-03-23 | Published 2026-03-27 | Updated 2026-03-27 | Assigner GitHub_M




HIGH: 7.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Problem types

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

<= 26.0
affected

References

github.com/...AVideo/security/advisories/GHSA-fj74-qxj7-r3vc

github.com/...ommit/0215d3c4f1ee748b8880254967b51784b8ac4080

cve.org (CVE-2026-33767)

nvd.nist.gov (CVE-2026-33767)

Download JSON