WWBN AVideo contains an unauthenticated SQL injection flaw in the objects/videos.json.php and objects/video.php handlers. The application does not sanitize the catName parameter when it is supplied via a JSON-formatted POST request body, and JSON input is merged into the $_REQUEST array after global security checks. This allows an attacker to inject arbitrary SQL statements that can read, modify, or delete data in the underlying database. The vulnerability is a high‑severity flaw and could compromise confidentiality and integrity of database information.

All installations of WWBN AVideo older than version 24.0 are affected. The flaw resides in the objects/videos.json.php and objects/video.php components where the catName field is not validated when supplied through a JSON body.

The CVSS score is 9.8 and the EPSS probability is 21%, indicating a critical risk for deployments exposed to the public. Because the endpoint accepts unauthenticated POST requests, an attacker can exploit the flaw from any network position with minimal effort. This vulnerability is not yet listed in CISA’s KEV catalog. Since the JSON payload is processed after global checks, no additional authentication or privilege is required, making the attack vector straightforward and repeatable.