CVE-2026-33723

Summary

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the Subscribe::save() method in objects/subscribe.php concatenates the $this->users_id property directly into an INSERT SQL query without sanitization or parameterized binding. This property originates from $_POST['user_id'] in both subscribe.json.php and subscribeNotify.json.php. An authenticated attacker can inject arbitrary SQL to extract sensitive data from any database table, including password hashes, API keys, and encryption salts. Commit 36dfae22059fbd66fd34bbc5568a838fc0efd66c contains a patch.

Affected Software

Weaknesses

• CWE-89: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

Additional References

• https://github.com/WWBN/AVideo/security/advisories/GHSA-ffr8-fxhv-fv8h

References

• https://github.com/WWBN/AVideo/security/advisories/GHSA-ffr8-fxhv-fv8h
• https://github.com/WWBN/AVideo/commit/36dfae22059fbd66fd34bbc5568a838fc0efd66c

• ←Previous
• Next→