The vulnerability resides in the static method fixCleanTitle() in objects/category.php. It builds a SQL SELECT query by directly inserting the $clean_title and $id values into the query string without using prepared statements. Because of this, an attacker who can trigger category creation or renaming with a crafted title can inject arbitrary SQL statements, which can lead to unauthorized data disclosure, modification, or deletion. This flaw is a classic case of CWE‑89 (SQL injection).

The affected product is WWBN AVideo, an open‑source video platform. Versions up to and including 26.0 are impacted. The vulnerability is present in the category handling code and can be triggered by any user who has capability to create or rename categories within the platform.

The CVSS base score of 7.1 indicates a high‑severity flaw. The EPSS score is below 1 %, suggesting a low likelihood of exploitation in the wild, and the flaw is not listed in the CISA KEV catalog. The exploitation path requires the attacker to interact with the category API or admin interface, providing a specially crafted title value. Although the vector is likely via local or remote web interface, the need for category manipulation limits the scope to users with those privileges.