SQL Injection in Wwbn Avideo
CVE-2026-85155
WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php endpoint with APIName=channels that allows unauthenticated attackers to order results by arbitrary database columns including users.password and users.recoverPass. Attackers can exploit this ordering oracle to infer password hash values and recovery tokens, and trigger SQL errors that disclose the full query statement and database schema.
Vulnerability class: SQL Injection
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.005 (38.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 39th percentile — 38.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.005 · change: +0.002
Affected products
Weakness classification (CWE)
References
- github.com/WWBN/AVideo/security/advisories/GHSA-pmmj-6425-gpgh (vendor-advisory)
- www.vulncheck.com/advisories/wwbn-avideo-sql-injection-via-get-json-php-apiname… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-85155?
- CVE-2026-85155 is a high-severity vulnerability in Wwbn Avideo, classified under SQL Injection. CVSS score: 7.5/10. Published 2026-09-03.
- How severe is CVE-2026-85155?
- High severity. CVSS v3 base score is 7.5 out of 10.