A SQL injection flaw exists in the AVideo video platform, where the videos_id parameter is concatenated directly into a prepared SQL statement. This partial use of prepared statements allows an attacker who can control the videos_id value—typically via a crafted HTTP request—to inject arbitrary SQL commands. The injected SQL can lead to unauthorized data reading, modification, or deletion, thereby compromising the confidentiality and integrity of the application’s database.

The vulnerability affects the WWBN AVideo platform in all releases up to and including version 26.0. The flaw resides in the objects/like.php file, which is part of the core video‑handling logic. Users running any affected build of AVideo should be aware that the system is susceptible to SQL injection through the like functionality.

The issue carries a CVSS score of 7.1, indicating moderate to high severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to supply a crafted videos_id parameter, which can be performed from an unauthenticated or authenticated request to the like endpoint. Once executed, the attacker can execute arbitrary SQL statements against the database.