In versions of the AVideo video platform before 26.0, the getAllCategories() method processes the doNotShowCats request parameter by removing only single‑quote characters. This removal can be bypassed with a backslash escape, allowing attackers to craft requests that inject arbitrary SQL into the database query. Because the application exposes this vulnerability to unauthenticated users, the injected SQL can read, modify, or delete data in the database, compromising confidentiality, integrity, and availability of stored media and metadata.

All deployments of the open‑source AVideo platform running any release older than 26.0 are affected. The code harboring the flaw exists in the core application files and has been fixed starting with the 26.0 release.

The flaw carries a CVSS score of 9.8, indicating a high‑severity risk. No defined exploit probability score is available, and the vulnerability is not listed among known exploited vulnerabilities. The lack of authentication requirements means the attack can be performed over the network with simple HTTP requests, and an attacker could retrieve or alter any database content.