CVE-2026-33651

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `remindMe.json.php` endpoint passes `$_REQUEST['live_schedule_id']` through multiple functions without sanitization until it reaches `Scheduler_commands::getAllActiveOrToRepeat()`, which directly concatenates it into a SQL `LIKE` clause. Although intermediate functions (`new Live_schedule()`, `getUsers_idOrCompany()`) apply `intval()` internally, they do so on local copies within `ObjectYPT::getFromDb()`, leaving the original tainted variable unchanged. Any authenticated user can perform time-based blind SQL injection to extract arbitrary database contents. Commit 75d45780728294ededa1e3f842f95295d3e7d144 contains a patch.

• CWE-89

• https://github.com/WWBN/AVideo/commit/75d45780728294ededa1e3f842f95295d3e7d144Patch
• https://github.com/WWBN/AVideo/security/advisories/GHSA-pvw4-p2jm-chjmExploit, Vendor Advisory

Published

Mar 23, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33645Fireshare facilitates self-hosted media and link sharing. In…8.1
• CVE-2026-33646mise manages dev tools like node, python, cmake, and terrafo…9.6
• CVE-2026-33647WWBN AVideo is an open source video platform. In versions up…8.8
• CVE-2026-33648WWBN AVideo is an open source video platform. In versions up…8.8
• CVE-2026-33649WWBN AVideo is an open source video platform. In versions up…8.8
• CVE-2026-33650WWBN AVideo is an open source video platform. In versions up…7.6
• CVE-2026-33653Ulloady is a file uploader script with multi-file upload sup…5.4
• CVE-2026-33654nanobot is a personal AI assistant. Prior to version 0.1.6, …9.8
• CVE-2026-33655New API is a large language mode (LLM) gateway and artificia…7.7
• CVE-2026-33656EspoCRM is an open source customer relationship management a…9.1
• CVE-2026-33657EspoCRM is an open source customer relationship management a…5.4
• CVE-2026-33658Active Storage allows users to attach cloud and local files …6.5