CVE-2026-28501

WWBN AVideo is an open source video platform. Prior to version 24.0, an unauthenticated SQL Injection vulnerability exists in AVideo within the objects/videos.json.php and objects/video.php components. The application fails to properly sanitize the catName parameter when it is supplied via a JSON-formatted POST request body. Because JSON input is parsed and merged into $_REQUEST after global security checks are executed, the payload bypasses the existing sanitization mechanisms. This issue has been patched in version 24.0.

• CWE-89

• https://github.com/WWBN/AVideo/commit/0c10be681c64044618ab94473251bd7c9b114fa1Patch
• https://github.com/WWBN/AVideo/releases/tag/24.0Product, Release Notes
• https://github.com/WWBN/AVideo/security/advisories/GHSA-pv87-r9qf-x56pVendor Advisory

Published

Mar 6, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-28496FOSSBilling is a free, open-source billing and client manage…9.4
• CVE-2026-28497TinyWeb is a web server (HTTP, HTTPS) written in Delphi for …9.1
• CVE-2026-28498Authlib is a Python library which builds OAuth and OpenID Co…7.5
• CVE-2026-28499LeafKit is a templating language with Swift-inspired syntax.…6.1
• CVE-2026-2850A vulnerability was found in yeqifu warehouse up to aaf29962…6.5
• CVE-2026-28500Open Neural Network Exchange (ONNX) is an open standard for …9.1
• CVE-2026-28502WWBN AVideo is an open source video platform. Prior to versi…8.8
• CVE-2026-28503Tandoor Recipes is an application for managing recipes, plan…6.5
• CVE-2026-28505Tautulli is a Python based monitoring and tracking tool for …10
• CVE-2026-28506Outline is a service that allows for collaborative documenta…4.3
• CVE-2026-28507Idno is a social publishing platform. Prior to version 1.6.4…7.2
• CVE-2026-28508Idno is a social publishing platform. Prior to version 1.6.4…8.6