All in One Video Downloader 1.2 contains a classic SQL injection flaw that can be triggered by unsanitized input in the id parameter of the admin interface. Because the application does not require authentication for this endpoint, an attacker can send specially crafted requests to the site and retrieve sensitive information from the database, such as usernames, database names, and MySQL version details. The vulnerability exposes the logic to arbitrary SQL code execution, allowing data theft and potentially enabling deeper compromise of the web application.

The affected product is Nicheoffice’s All in One Video Downloader, version 1.2. No other versions are listed as insecure in the current advisory.

The CVSS score of 8.8 marks the flaw as high‑severity, and the absence of authentication control makes exploitation trivial for an attacker with network access to the admin page. Because the EPSS score is not available, the exact likelihood of attack cannot be quantified, but the fact that the vulnerability is publicly known and listed by exploit‑db indicates that it is actively being exploited in the wild. The advisement is not part of the CISA KEV catalog, yet the inherent risks of data leakage and possible compromise warrant immediate remediation.