CVE-2026-33352Disclosure(wwbn / avideo)

LOWCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch wwbn avideo systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

WWBN AVideo is an open source video platform. Prior to version 26.0, an unauthenticated SQL injection vulnerability exists in `objects/category.php` in the `getAllCategories()` method. The `doNotShowCats` request parameter is sanitized only by stripping single-quote characters (`str_replace("'", '', ...)`), but this is trivially bypassed using a backslash escape technique to shift SQL string boundaries. The parameter is not covered by any of the application's global input filters in `objects/security.php`. Version 26.0 contains a patch for the issue.

wwbn CVEs Back to dashboard

2.0/ 10 priority

Sources & remediation

Patch / fix

https://github.com/WWBN/AVideo/commit/206d38e97b8c854771bb2907b13f9f36e8bcf874

Exploit / PoC references

https://github.com/WWBN/AVideo/security/advisories/GHSA-mcj5-6qr4-95fj

Weakness type (CWE)

CWE-89

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

avideo

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
6 mentions across 3 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 2 signals
Technical details provided in 6 signals
Disclosure: 5 classified signals
Peaked 1d ago at 3 mentions (2026-03-23); latest day: 1
6 total mentions across 3 days

Affected systems

Vendors

wwbn

Products

avideo

Deep dive

Activity timeline6 mentions / 3d

Signal classification2 categories

Disclosure

583.3%

Patch

116.7%

Referenced assets6 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-20	2	Disclosure2
2026-03-23	3	Disclosure2Patch1
2026-03-24	1	Disclosure1

Full discourse6 posts

0day Signal@0dayPublishing198d
Disclosure
🚨 CVE-2026-33352: AVideo has an Unauthenticated SQ... Single-quote stripping defeated by backslash escapes—classic SQL injection fundamentals bypassing amateur sanitization ... https://zerodaysignal.com/vulnerability/CVE-2026-33352 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The tweet discloses a new unauthenticated SQL injection (CVE-2026-33352) in AVideo, detailing how backslash escapes bypass sanitization. No exploitation activity or patch information is provided.
0000060
164 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds199d
Disclosure
CVE-2026-33352 SQL Injection in WWBN AVideo Before 26.0 via Unauthenticated Category Parameter https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-33352
Post summary
The post announces a SQL Injection flaw in WWBN AVideo before version 26.0, triggered via an unauthenticated category parameter, without providing PoC, exploit code, or remediation details.
0000027
4.0K followersView on X
CVEFind.com@CveFindCom199d
Patch
[CVE-2026-33352: CRITICAL] Open source video platform WWBN AVideo had a critical SQL injection vulnerability pre-version 26.0 in `objects/category.php`. The issue was fixed in version 26.0. #cybersecurity#cve,CVE-2026-33352,#cybersecurity https://cvefind.com/CVE-2026-33352
Post summary
A critical SQL injection was identified in pre‑26.0 versions of WWBN AVideo and was fixed in version 26.0; no PoC, exploit tool, or evidence of active exploitation is mentioned.
0000029
606 followersView on X
The Hacker Wire@TheHackerWire199d
Disclosure
🔴 CVE-2026-33352 - Critical WWBN AVideo is an open source video platform. Prior to version 26.0, an unauthenticated SQL injection vulnerability exists in `objects/category.php` in the `getAllCategories()` method. Th... https://www.thehackerwire.com/vulnerability/CVE-2026-33352/ https://t.co/OcpsGmCSsL
Post summary
The tweet announces a critical SQL injection vulnerability in WWBN AVideo prior to version 26.0, providing the vulnerability type but no evidence of exploitation or mitigation.
0000030
144 followersView on X
PulsePatch.io@pulsepatchio202d
Disclosure
`AVideo` is affected by an unauthenticated SQL injection (CVE-2026-33352). This allows database compromise and potential RCE. Patching is critical. #SQLi #WebSecurity #InfoSec https://www.pulsepatch.io/posts/cve-2026-33352-avideo-sql-injection
Post summary
The post announces CVE‑2026‑33352 as an unauthenticated SQL injection affecting AVideo, warns of potential RCE, and stresses the importance of applying the vendor patch.
0000039
1 followersView on X
Vulert@vulert_official202d
Disclosure
🚨 Critical SQL Injection in AVideo CVE-2026-33352 could put affected systems at serious risk through SQL injection attacks. 🔎 More details: https://vulert.com/vuln-db/CVE-2026-33352 #CyberSecurity #SQLInjection #CVE202633352 #AVideo #AppSec #DevSecOps #OpenSourceSecurity #Vulert https://t.co/OFqe97BYuO
Post summary
The tweet announces a critical SQL injection vulnerability (CVE-2026-33352) in AVideo, linking to a source for more details but offering no exploit code or patch information.
0000044
123 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	wwbn	avideo	-	-	-

Explore more

Back to dashboard wwbn CVEs avideo vulnerabilities

What researchers are saying

CVE-2026-33352

0day Signal@0dayPublishingDisclosure

The tweet discloses a new unauthenticated SQL injection (CVE-2026-33352) in AVideo, detailing how backslash escapes bypass sanitization. No exploitation activity or patch information is provided.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The post announces a SQL Injection flaw in WWBN AVideo before version 26.0, triggered via an unauthenticated category parameter, without providing PoC, exploit code, or remediation details.

CVEFind.com@CveFindComPatch

A critical SQL injection was identified in pre‑26.0 versions of WWBN AVideo and was fixed in version 26.0; no PoC, exploit tool, or evidence of active exploitation is mentioned.

The Hacker Wire@TheHackerWireDisclosure

The tweet announces a critical SQL injection vulnerability in WWBN AVideo prior to version 26.0, providing the vulnerability type but no evidence of exploitation or mitigation.

PulsePatch.io@pulsepatchioDisclosure

The post announces CVE‑2026‑33352 as an unauthenticated SQL injection affecting AVideo, warns of potential RCE, and stresses the importance of applying the vendor patch.

Vulert@vulert_officialDisclosure

The tweet announces a critical SQL injection vulnerability (CVE-2026-33352) in AVideo, linking to a source for more details but offering no exploit code or patch information.