CVE-2026-33767

CVE-2026-33767 · AVideo has SQL Injection via Partial Prepared Statement — videos_id Concatenated Directly into Query

Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.

WWBN AVideo is an open source video platform. In versions up to and including 26.0, in `objects/like.php`, the `getLike()` method constructs a SQL query using a prepared statement placeholder (`?`) for `users_id` but directly concatenates `$this->videos_id` into the query string without parameterization. An attacker who can control the `videos_id` value (via a crafted request) can inject arbitrary SQL, bypassing the partial prepared-statement protection. Commit 0215d3c4f1ee748b8880254967b51784b8ac4080 contains a patch.

CVSS 7.1 · Hoch · EPSS 0,5% · Korrektur verfügbar

Veröffentlicht

2026-03-27T16:12:36.907Z

Aktualisiert

2026-03-27T17:27:42.793Z

Technologie-Stack: php

Prüfen Sie Ihren Server →