SQL Injection in Wwbn Avideo
CVE-2026-33770
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `fixCleanTitle()` static method in `objects/category.php` constructs a SQL SELECT query by directly interpolating both `$clean_title` and `$id` into th…
Vulnerability class: SQL Injection
EPSS: 0.000 (8.0th percentile) — read the EPSS interpretation.
Affected products
- Wwbn Avideo — versions <= 26.0
Weakness classification (CWE)
References
- https://github.com/WWBN/AVideo/security/advisories/GHSA-584p-rpvq-35vf (x_refsource_CONFIRM)
- https://github.com/WWBN/AVideo/commit/994cc2b3d802b819e07e6088338e8bf4e484aae4 (x_refsource_MISC)