CVE-2026-28501 json
WWBN AVideo: Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php
published 8mo ago modified 4mo ago also EUVD-2026-9970 , GHSA-pv87-r9qf-x56p
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.7%
- EPSS 1.7% chance of exploitation in 30 days, percentile 76%
- public exploits
- 1
- Metasploit
Summary
WWBN AVideo is an open source video platform. Prior to version 24.0, an unauthenticated SQL Injection vulnerability exists in AVideo within the objects/videos.json.php and objects/video.php components. The application fails to properly sanitize the catName parameter when it is supplied via a JSON-formatted POST request body. Because JSON input is parsed and merged into $_REQUEST after global security checks are executed, the payload bypasses the existing sanitization mechanisms. This issue has been patched in version 24.0.
Patch / fix
- wwbn avideo 24.0
Is CVE-2026-28501 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerTimeline
- Published
- First public exploit (Metasploit auxiliary/gather/avideo_catname_sqli)
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 8mo ago
Exploit prediction
1.67% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- Metasploit auxiliary/gather/avideo_catname_sqli AVideo Unauthenticated SQL Injection Credential Dump metasploit auxiliary, normal rank, 2026-03-05
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | wwbn/avideo | <=21.0.0 |
no fix listed |
Affected products
- WWBN AVideo
Classification
- Weakness
-
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
-
github.com
/WWBN/AVideo/commit/0c10be681c64044618ab94473251bd7c9b114fa1
web, patch
-
github.com
/WWBN/AVideo/security/advisories/GHSA-pv87-r9qf-x56p
web, vendor-advisory
-
github.com
/WWBN/AVideo/releases/tag/24.0
web, product, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2026-28501
advisory
-
github.com
/WWBN/AVideo
package
Sources
- CVE List CVE-2026-28501
- GitHub Advisory GHSA-pv87-r9qf-x56p
- NVD CVE-2026-28501
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.