PT-2026-22880 · Avideo · Avideo

Daniel Neto · Published 2026-03-02 · Updated 2026-04-17 · CVE-2026-28501

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 23

Description The software contains an unauthenticated SQL injection flaw within the objects/videos.json.php and objects/video.php components. The application does not properly sanitize the catName parameter when received in a JSON-formatted POST request, bypassing existing security checks. This allows an attacker to execute arbitrary SQL queries, potentially leading to database exfiltration, extraction of sensitive data like administrator usernames and password hashes, privilege escalation, and full system compromise. The issue is categorized as CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection).

Recommendations Upgrade to version 23 or later.

Exploit

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-28501

GHSA-PV87-R9QF-X56P

Affected Products

Avideo

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28501.json · Exploit
• https://github.com/WWBN/AVideo/security/advisories/GHSA-pv87-r9qf-x56p · Vendor Advisory
• https://github.com/WWBN/AVideo/commit/0c10be681c64044618ab94473251bd7c9b114fa1 · Patch
• https://osv.dev/vulnerability/GHSA-pv87-r9qf-x56p · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-28501 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28501 · Security Note
• https://github.com/WWBN/AVideo · Note
• https://github.com/WWBN/AVideo/releases/tag/24.0 · Note
• https://reddit.com/r/SecOpsDaily/comments/1sodix5/metasploit_wrapup_04172026 · Reddit Post
• https://twitter.com/the_yellow_fall/status/2029034678905172401 · Twitter Post
• https://twitter.com/TheHackerWire/status/2029863462223106392 · Twitter Post
• https://twitter.com/cracbot/status/2031686820778688601 · Twitter Post
• https://twitter.com/cyberbivash/status/2029786064819228741 · Twitter Post
• https://t.me/cveNotify/155505 · Telegram Post
• https://twitter.com/CveFindCom/status/2029779507331190860 · Twitter Post