What is CVE-2026-85155?

CVE-2026-85155 is a high-severity vulnerability, classified under SQL Injection. CVSS score: 7.5/10. Published 2026-09-03.

How severe is CVE-2026-85155?

High severity. CVSS v3 base score is 7.5 out of 10.

CVE-2026-85155

CVE-2026-85155

WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php endpoint with APIName=channels that allows unauthenticated attackers to order results by arbitrary database columns including users.password and users.recoverPass. Attackers can exploit this ordering oracle to infer password hash values and recovery tokens, and trigger SQL errors that disclose the full query statement and database schema.

Vulnerability class: SQL Injection

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Weakness classification (CWE)

CWE-89 — SQL Injection

References

disclosure@vulncheck.com
disclosure@vulncheck.com

Frequently asked questions

What is CVE-2026-85155?: CVE-2026-85155 is a high-severity vulnerability, classified under SQL Injection. CVSS score: 7.5/10. Published 2026-09-03.
How severe is CVE-2026-85155?: High severity. CVSS v3 base score is 7.5 out of 10.