Critical severity9.8NVD Advisory· Published Mar 27, 2026· Updated Mar 31, 2026
CVE-2026-33770
CVE-2026-33770
Description
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the fixCleanTitle() static method in objects/category.php constructs a SQL SELECT query by directly interpolating both $clean_title and $id into the query string without using prepared statements or parameterized queries. An attacker who can trigger category creation or renaming with a crafted title value can inject arbitrary SQL. Commit 994cc2b3d802b819e07e6088338e8bf4e484aae4 contains a patch.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
wwbn/avideoPackagist | <= 26.0 | — |
Affected products
2Patches
Vulnerability mechanics
References
4- github.com/WWBN/AVideo/commit/994cc2b3d802b819e07e6088338e8bf4e484aae4nvdPatchWEB
- github.com/WWBN/AVideo/security/advisories/GHSA-584p-rpvq-35vfnvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-584p-rpvq-35vfghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-33770ghsaADVISORY
News mentions
0No linked articles in our index yet.