CVE-2026-33767

CVE-2026-33767 · AVideo has SQL Injection via Partial Prepared Statement — videos_id Concatenated Directly into Query

This page contains facts from public vulnerability sources. Check the original advisory before updating.

WWBN AVideo is an open source video platform. In versions up to and including 26.0, in `objects/like.php`, the `getLike()` method constructs a SQL query using a prepared statement placeholder (`?`) for `users_id` but directly concatenates `$this->videos_id` into the query string without parameterization. An attacker who can control the `videos_id` value (via a crafted request) can inject arbitrary SQL, bypassing the partial prepared-statement protection. Commit 0215d3c4f1ee748b8880254967b51784b8ac4080 contains a patch.

CVSS 7.1 · High · EPSS 0.5% · Fix available

Published

2026-03-27T16:12:36.907Z

Updated

2026-03-27T17:27:42.793Z

Stack: php

Check your server →