CVE-2026-33767

CVE-2026-33767 · AVideo has SQL Injection via Partial Prepared Statement — videos_id Concatenated Directly into Query

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

WWBN AVideo is an open source video platform. In versions up to and including 26.0, in `objects/like.php`, the `getLike()` method constructs a SQL query using a prepared statement placeholder (`?`) for `users_id` but directly concatenates `$this->videos_id` into the query string without parameterization. An attacker who can control the `videos_id` value (via a crafted request) can inject arbitrary SQL, bypassing the partial prepared-statement protection. Commit 0215d3c4f1ee748b8880254967b51784b8ac4080 contains a patch.

CVSS 7.1 · Alta · EPSS 0,5% · Corrección disponible

Publicación

2026-03-27T16:12:36.907Z

Actualización

2026-03-27T17:27:42.793Z

Pila tecnológica: php

Comprueba tu servidor →