Vulnerability · Published Mar 27, 2026 · Assigned by GitHub_M

CVE-2026-33767AVideo has SQL Injection via Partial Prepared Statement — videos_id Concatenated Directly into Query

High 7.1

In plain English

A high-severity SQL injection in AVideo from WWBN. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)7.1High

Exploit odds (30 days)0.5%top 55.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

WWBN AVideo is an open source video platform. In versions up to and including 26.0, in `objects/like.php`, the `getLike()` method constructs a SQL query using a prepared statement placeholder (`?`) for `users_id` but directly concatenates `$this->videos_id` into the query string without parameterization. An attacker who can control the `videos_id` value (via a crafted request) can inject arbitrary SQL, bypassing the partial prepared-statement protection. Commit 0215d3c4f1ee748b8880254967b51784b8ac4080 contains a patch.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	wwbn/avideo	26.0	GHSA-fj74-qxj7-r3vc

Affected products (as reported)

Vendor	Product	Versions
WWBN	AVideo	<= 26.0

Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-fj74-qxj7-r3vc x_refsource_CONFIRM
https://github.com/WWBN/AVideo/commit/0215d3c4f1ee748b8880254967b51784b8ac4080 x_refsource_MISC