EUVD-2026-69717

AVideo through version 29.0 contains an unauthenticated SQL injection vulnerability in the UserLocation plugin's regions.json.php and cities.json.php endpoints. The country and region GET parameters are passed directly into SQL queries without escaping or prepared statement binding, allowing...