CVE-2026-33651
WWBN AVideo is an open source video platform.
Published Mar 23, 2026 · updated Jun 17, 2026 · wwbn avideo
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the endpoint passes through multiple functions without sanitization until it reaches , which directly concatenates it into a SQL clause. Although intermediate functions ( , ) apply internally, they do so on local copies within , leaving the original tainted variable unchanged. Any authenticated user can perform time-based blind SQL injection to extract arbitrary database contents. Commit 75d45780728294ededa1e3f842f95295d3e7d144 contains a patch.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 23, 2026 · NIST NVD
Detected
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the endpoint passes through multiple functions without sanitization until it reaches , which directly concatenates it into a SQL clause. Although intermediate functions ( , ) apply internally, they do so on local copies within , leaving the original tainted variable unchanged. Any authenticated user can perform tim
Jun 17, 2026 · NIST NVD
Updated
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the endpoint passes through multiple functions without sanitization until it reaches , which directly concatenates it into a SQL clause. Although intermediate functions ( , ) apply internally, they do so on local copies within , leaving the original tainted variable unchanged. Any authenticated user can perform tim
Affected
- cpe wwbn/avideoversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-33651
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-33651
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the endpoint passes through multiple functions without sanitization until it reaches , which direc
nvd.nist.gov