CVE-2026-28501

🗓️ 06 Mar 2026 03:05:21Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 20 Views🌐 WEB

Unauthenticated SQL injection in AVideo via a JSON POST; affects videos.json.php and video.php; fixed 24.0.

Reporter	Title	Published	Views	Family All 14
ATTACKERKB	CVE-2026-28501	6 Mar 202603:05	–	attackerkb
Circl	CVE-2026-28501	6 Mar 202604:11	–	circl
CNNVD	WWBN AVideo SQL注入漏洞	6 Mar 202600:00	–	cnnvd
Cvelist	CVE-2026-28501 WWBN AVideo: Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php	6 Mar 202603:05	–	cvelist
Github Security Blog	AVideo has Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php	2 Mar 202620:49	–	github
Metasploit	AVideo Unauthenticated SQL Injection Credential Dump	10 Apr 202619:02	–	metasploit
NVD	CVE-2026-28501	6 Mar 202604:16	–	nvd
OSV	CVE-2026-28501 WWBN AVideo: Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php	6 Mar 202603:05	–	osv
OSV	GHSA-PV87-R9QF-X56P AVideo has Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php	2 Mar 202620:49	–	osv
Positive Technologies	PT-2026-22880	2 Mar 202600:00	–	ptsecurity

NVD

Vulners

Node

wwbn avideoRange<24.0

[
  {
    "vendor": "WWBN",
    "product": "AVideo",
    "versions": [
      {
        "version": "< 24.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/WWBN/AVideo/security/advisories/GHSA-pv87-r9qf-x56p
github	www.github.com/WWBN/AVideo/commit/0c10be681c64044618ab94473251bd7c9b114fa1
github	www.github.com/WWBN/AVideo/releases/tag/24.0

Parameter	Position	Path	Description	CWE
catName	request body	objects/videos.json.php	Unauthenticated SQL injection via JSON input in catName parameter to objects/videos.json.php (CVE-2026-28501). JSON input bypasses existing sanitization, enabling time-based blind injection.	CWE-89

17 Jun 2026 10:28Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.19.8

EPSS0.0151

SSVC

CWE-89