EUVD-2026-69717

AVideo through version 29.0 contains an unauthenticated SQL injection vulnerability in the UserLocation plugin's regions.json.php and cities.json.php endpoints. The country and region GET parameters are passed directly into SQL queries without escaping or prepared statement binding, allowing...

CVE-2026-84208

AVideo through version 29.0 contains an unauthenticated SQL injection vulnerability in the UserLocation plugin's regions.json.php and cities.json.php endpoints. The country and region GET parameters are passed directly into SQL queries without escaping or prepared statement binding, allowing...

CVE-2026-84208

AVideo through version 29.0 contains an unauthenticated SQL injection vulnerability in the User_Location plugin , specifically in the regions.json.php and cities.json.php endpoints. The root cause is that the country and region GET parameters are passed directly into SQL queries without escaping ...

CVE-2026-34739: Improper Neutralization of Input During Web Page Generation

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the UserLocation plugin's testIP.php page reflects the ip request parameter directly into an HTML input element without applying htmlspecialchars or any other output encoding. This allows an attacker to inject arbitrary HTM...