CVE-2026-33025

AVideo is a video-sharing Platform. Versions prior to 8.0 contain a SQL Injection vulnerability in the getSqlFromPost() method of Object.php. The $_POST['sort'] array keys are used directly as SQL column identifiers inside an ORDER BY clause. Although real_escape_string() was applied, it only escapes string-context characters (quotes, null bytes) and provides no protection for SQL identifiers — making it entirely ineffective here. This issue has been fixed in version 8.0. To workaround this issue without upgrading, operators can apply a WAF rule to block POST requests where any sort[*] key contains characters outside [A-Za-z0-9_]. Alternatively, restrict access to the queue view (queue.json.php, index.php) to trusted IP ranges only.

• CWE-89

• https://github.com/WWBN/AVideo-Encoder/commit/d1c8a17ac88b5e27da9dfb7a230bbaf54aa53124Patch
• https://github.com/WWBN/AVideo-Encoder/security/advisories/GHSA-5qvj-5h75-27pjMitigation, Vendor Advisory

Published

Mar 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-3302A weakness has been identified in SourceCodester Doctor Appo…6.1
• CVE-2026-33020libsixel is a SIXEL encoder/decoder implementation derived f…7.1
• CVE-2026-33021libsixel is a SIXEL encoder/decoder implementation derived f…7.3
• CVE-2026-33022Tekton Pipelines project provides k8s-style resources for de…6.5
• CVE-2026-33023libsixel is a SIXEL encoder/decoder implementation derived f…7.8
• CVE-2026-33024AVideo is a video-sharing Platform. Versions prior to 8.0 co…9.1
• CVE-2026-33026Nginx UI is a web user interface for the Nginx web server. P…9.1
• CVE-2026-33027Nginx UI is a web user interface for the Nginx web server. P…6.5
• CVE-2026-33028Nginx UI is a web user interface for the Nginx web server. P…7.5
• CVE-2026-33029Nginx UI is a web user interface for the Nginx web server. P…6.5
• CVE-2026-33030Nginx UI is a web user interface for the Nginx web server. I…9.9
• CVE-2026-33031Nginx UI is a web user interface for the Nginx web server. P…8.1