High severity7.5NVD Advisory· Published Sep 1, 2026· Updated Sep 8, 2026
CVE-2026-84208
CVE-2026-84208
Description
AVideo through version 29.0 contains an unauthenticated SQL injection vulnerability in the User_Location plugin's regions.json.php and cities.json.php endpoints. The country and region GET parameters are passed directly into SQL queries without escaping or prepared statement binding, allowing unauthenticated attackers to execute UNION-based SQL injection to read arbitrary database contents including password hashes and sensitive data.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
2News mentions
1- WWBN AVideo: 25 Vulnerabilities Disclosed in Early September 2026 BatchVypr Intelligence · Sep 5, 2026