CVE-2026-33025: high-severity vulnerability in WWBN AVideo-Encoder
AVideo-Encoder is Vulnerable to Authenticated SQL Injection via ORDER BY Clause
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.6epss 0.4%
AVideo is a video-sharing Platform. Versions prior to 8.0 contain a SQL Injection vulnerability in the getSqlFromPost() method of Object.php. The $_POST['sort'] array keys are used directly as SQL column identifiers inside an ORDER BY clause. Although real_escape_string() was applied, it only escapes string-context characters (quotes, null bytes) and provides no protection for SQL identifiers — making it entirely ineffective here. This issue has been fixed in version 8.0. To workaround this issue without upgrading, operators can apply a WAF rule to block POST requests where any sort[*] key contains characters outside [A-Za-z0-9_]. Alternatively, restrict access to the queue view (queue.json.php, index.php) to trusted IP ranges only.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
WWBN · AVideo-EncoderRelated CVEs — WWBN AVideo-Encoder
In the same product, most dangerous first.
CVE-2026-29058CRITICALAVideo: Unauthenticated OS Command Injection via base64Url in objects/getImage.phpEPSS 8.9%CVE-2026-61564CRITICALAVideo-Encoder: unauthenticated installer PHP code injectionEPSS 0.5%CVE-2026-61567CRITICALAVideo-Encoder: unauthenticated command execution through streamer login trustEPSS 0.5%CVE-2026-33024CRITICALAVideo-Encoder has Unauthenticated Blind Server-Side Request Forgery via Public Thumbnail GeneratorEPSS 0.4%CVE-2026-61569HIGHAVideo-Encoder: pre-authentication streamer-login SQL injectionEPSS 0.3%CVE-2026-61571HIGHAVideo-Encoder: missing authentication on control and status endpointsEPSS 0.3%