CVE-2026-33767

WWBN AVideo is an open source video platform. In versions up to and including 26.0, in "objects/like.php", the "getLike" method constructs a SQL query using a prepared statement placeholder "?" for "usersid" but directly concatenates "$this-videosid" into the query string without parameterization...

CVE-2026-33767: Improper Neutralization of Special Elements used in an SQL Command

WWBN AVideo is an open source video platform. In versions up to and including 26.0, in objects/like.php, the getLike method constructs a SQL query using a prepared statement placeholder ? for usersid but directly concatenates $this-videosid into the query string without parameterization. An...

PT-2026-28537

Name of the Vulnerable Software and Affected Versions AVideo versions up to and including 26.0 Description AVideo is susceptible to a SQL injection issue in the objects/like.php file. The getLike method uses a prepared statement placeholder for users id but directly concatenates $this-videos id...