CVE-2026-28501: Wwbn/avideo SQL Injection Vulnerability
CRITICALCVE-2026-28501 is a CRITICAL (CVSS 9.8) sql injection vulnerability (CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')) affecting Wwbn/avideo libraries in the Packagist ecosystem. The issue involves avideo has unauthenticated sql injection via json request bypass in objects/videos.json.php. Remediation is available in the latest vendor maintenance releases.
CVE-2026-28501 at a Glance
Security Impact
CVSS: 9.8
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
How to Fix CVE-2026-28501
To remediate this vulnerability, upgrade all affected Wwbn/avideo dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade wwbn/avideo to Latest secure releaseRun the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for wwbn/avideoHow to Check if You Are Affected
To determine whether your application is affected by CVE-2026-28501, inspect your project dependencies for Wwbn/avideo:
inspect dependencies for wwbn/avideoAnalyze the terminal output to locate any version of Wwbn/avideo in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), where the product constructs all or part of an sql command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended sql command when it is sent to a downstream component. without sufficient removal or quoting of sql syntax in user-controllable inputs, the generated sql query can cause those inputs to be interpreted as sql instead of ordinary user data. In Wwbn/avideo, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-28501 Affected Wwbn/avideo Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
wwbn/avideo
|
Packagist |
≤ 21.0.0
|
|
References
Frequently Asked Questions
What is CVE-2026-28501?
Which Wwbn/avideo versions are affected?
What version fixes CVE-2026-28501?
Is wwbn/avideo affected?
What is the CVSS score of CVE-2026-28501?
What CWE is associated with CVE-2026-28501?
How can I check Packagist dependencies for CVE-2026-28501?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-pv87-r9qf-x56p",
"modified" : "2026-03-06T14:23:56Z",
"published" : "2026-03-02T20:49:43Z",
"aliases" : [ "CVE-2026-28501" ],
"summary" : "AVideo has Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php",
"details" : "## Impact\n\nAn unauthenticated SQL Injection vulnerability exists in AVideo within the objects/videos.json.php and objects/video.php components.\n\nThe application fails to properly sanitize the catName parameter when it is supplied via a JSON-formatted POST request body. Because JSON input is parsed and merged into $_REQUEST after global security checks are executed, the payload bypasses the existing sanitization mechanisms.\n\nThis allows an unauthenticated attacker to:\n\n- Execute arbitrary SQL queries\n- Perform full database exfiltration\n- Extract sensitive data including administrator usernames, password hashes, session identifiers and user records\n- Potentially escalate privileges by cracking password hashes offline\n- Chain with authenticated vulnerabilities to achieve full system compromise\n\nThis vulnerability is classified as:\n- CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)\n\n\n## Patches\n\nThis vulnerability has been fixed in version 23.\n\nUsers must upgrade to version 23 or later.\n\n\n## Workarounds\n\nThere is no reliable workaround.\n\nThe only recommended mitigation is to upgrade immediately to version 23 upon its release.\n\n\n## References\n\nInternal security report.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Packagist",
"name" : "wwbn/avideo"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"last_affected" : "21.0.0"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/WWBN/AVideo/security/advisories/GHSA-pv87-r9qf-x56p"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-28501"
}, {
"type" : "WEB",
"url" : "https://github.com/WWBN/AVideo/commit/0c10be681c64044618ab94473251bd7c9b114fa1"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/WWBN/AVideo"
}, {
"type" : "WEB",
"url" : "https://github.com/WWBN/AVideo/releases/tag/24.0"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-89" ],
"severity" : "CRITICAL",
"github_reviewed" : true,
"github_reviewed_at" : "2026-03-02T20:49:43Z",
"nvd_published_at" : "2026-03-06T04:16:08Z"
}
}